From: mil-veh@ziptar.com
Date: Wed Apr 21 2004 - 20:41:08 PDT
I received it today seems the list or someone on it got hit by it.
It contains virus, Norton corporate antivirus identified it as the
W32.Netsky.P@mm virus. Basically it exploits a bug in internet explorer,
once it infects a system it scans for email address and remails itself.
http://securityresponse.symantec.com/avcenter/venc/data/w32.netsky.p@mm.html
Return address is noreply@paypal.com. Anyone else get it??
I use a catch-all email on my domain so that I know where emails come from.
Basically I can make up email addresses on the fly and still get them. The
virus came to mil-veh at ziptar dot com. That's the one I use for this list.
You guys may want to update your antivirus profiles and run a scan, the link
above also gives things to look for.
came to me from:
IP address: 24.217.145.214
Host name: mv1-24.217.145.214.charter-stl.com
It didn't come in from skylee, leads me to believe someone on the list has
it.
Header info on the one I received: (I antispamed my info though..)
Received: from [24.217.145.214] (helo=ziptar(dot)com)
by mymailserver.com with esmtp (Exim 4.24)
id 1BGOWf-0001Bd-K8
for mil-veh(at)ziptar(dot)com; Wed, 21 Apr 2004 16:40:57 -0400
From: noreply@paypal.com
To: mil-veh(at)ziptar(dot)com
Subject: Congratulations!
Date: Wed, 21 Apr 2004 15:36:06 -0700
MIME-Version: 1.0
Content-Type: multipart/mixed;
boundary="----=_NextPart_000_0016----=_NextPart_000_0016"
X-Priority: 3
X-MSMail-Priority: Normal
Message-Id: <E1BGOWf-0001Bd-K8@mymailserver.com>
X-Spam-Exim: QaNzcGXFDpFghntHZpntvJ1Z
This archive was generated by hypermail 2.1.4 : Sat May 07 2005 - 20:29:36 PDT