SCOUG-HELP Mailing List Archives

<< Previous Message << >> Next Message >>

Date:	Fri, 26 Sep 2003 08:04:26 PDT7
From:	Peter Skye <pskye@peterskye.com >
Reply-To:	scoug-help@scoug.com
To:	scoug-help@scoug.com
Subject:	SCOUG-Help: Which virus emails are you getting ?

Content Type: text/plain

=====================================================
If you are responding to someone asking for help who
may not be a member of this list, be sure to use the
REPLY TO ALL feature of your email program.
=====================================================

Peter Skye wrote:
>
> For those of you who are also getting this stuff, are you
> getting just Swen (which looks like a Microsoft update), just
> Exploit (which looks like an email bounceback), or both?

Update on this. I compared the attachments in these two different
groups of messages and they're all the same.

So I extracted the base64 attachment and decoded it with uudeview, and
found the Microsoft "Swen" virus html and executable embedded in it.

What's apparently happening is that when this virus runs on a Windows
machine it spoofs someone else's email address as the sender. Thus, if
the recipient address is invalid and the message bounces, it is returned
to the spoofed "sender". I've read elsewhere that spoofing is often
done by using the infected machine's email address book or the addresses
from recently received emails.

That's apparently why I'm getting these two different virus messages --
102 of them (at 150K each) between 6pm last night and right now.

- Peter

=====================================================

To unsubscribe from this list, send an email message
to "steward@scoug.com". In the body of the message,
put the command "unsubscribe scoug-help".

For problems, contact the list owner at
"rollin@scoug.com".

=====================================================

Return to [ 26 | September | 2003 ]

SCOUG, Warp Expo West, and Warpfest are trademarks of the Southern California OS/2 User Group. OS/2, Workplace Shell, and IBM are registered trademarks of International Business Machines Corporation. All other trademarks remain the property of their respective owners.