Worm from jlester@thedieselstop.com

[ButcherGY54]

Subject: moin
Text: be mad?
Attachment: undefinied.scr

<font color="red">DO NOT OPEN! DELETE IMMEDIATELY!</font>

David

[yaric008]

uh.. what?

[ButcherGY54]

If your e-mail address is on Jason's machine you will get an e-mail. It will contain a worm type virus if it has the above subject.

David

[Ford_Forgotton]

JASON IS NOT INFECTED!!

Its called SPOOFING!

Dont worry, no one at TDS is trying to attack you.

HOWEVER, someone who Jason has either emailed, or has emailed jason HAS gotten infected and is spoofing jasons email to make it APPEAR like it came from him. I can assure you it didnt.

We have been getting them at work alot. Its the NetSky virus, or one of its MANY derivatives.

Do a GOOGLE search on spoofing and you will understand

[KRMNAL1]

and you know this why ??

[ButcherGY54]

WORM INFO

People.

I am merly telling you what I got in my Inbox. I am aware that it may not be from Jason, but I can not be sure either.

David

[Ford_Forgotton]

[ QUOTE ]
WORM INFO

People.

I am merly telling you what I got in my Inbox. I am aware that it may not be from Jason, but I can not be sure either.

David

[/ QUOTE ]

Of course you can be sure, just read the header file. It will tell you EXACTLY what system sent it. And I'll bet you a DieselStop Sticker it didnt come from Jason.

[ButcherGY54]

From - Wed Mar 10 09:25:23 2004
X-UIDL: 336-1027508493
X-Mozilla-Status: 0001
X-Mozilla-Status2: 00000000
Return-path: &lt;jlester@thedieselstop.com&gt;
Received: from mta25.srv.hcvlny.cv.net
(mta25.srv.hcvlny.cv.net [167.206.5.186]) by mstr8.srv.hcvlny.cv.net
(iPlanet Messaging Server 5.2 HotFix 1.16 (built May 14 2003))
with ESMTP id &lt;0HUD00FE62V90L@mstr8.srv.hcvlny.cv.net&gt; for
99f350sd@optonline.net; Wed, 10 Mar 2004 08:01:58 -0500 (EST)
Received: from optonline.net (ip2.sbair.qtm.net [216.163.34.178])
by mta25.srv.hcvlny.cv.net
(iPlanet Messaging Server 5.2 HotFix 1.16 (built May 14 2003))
with ESMTP id &lt;0HUD00F9O2V7YS@mta25.srv.hcvlny.cv.net&gt; for
99f350sd@optonline.net (ORCPT 99f350sd@optonline.net); Wed,
10 Mar 2004 08:01:57 -0500 (EST)
Date: Wed, 10 Mar 2004 08:01:49 -0500
From: jlester@thedieselstop.com
Subject: moin
To: 99f350sd@optonline.net
Message-id: &lt;0HUD00F9P2V7YS@mta25.srv.hcvlny.cv.net&gt;
MIME-version: 1.0
Content-type: multipart/mixed; boundary="Boundary_(ID_P/ixWsGMTGrfBlKnDzCjLw)"
X-Priority: 3
X-MSMail-priority: Normal
Original-recipient: rfc822;99f350sd@optonline.net

This is a multi-part message in MIME format.

--Boundary_(ID_P/ixWsGMTGrfBlKnDzCjLw)
Content-type: text/plain; charset=Windows-1252
Content-transfer-encoding: 7BIT

be mad?

--Boundary_(ID_P/ixWsGMTGrfBlKnDzCjLw)
Content-type: application/octet-stream; name=undefinied.scr
Content-transfer-encoding: base64
Content-disposition: attachment; filename=undefinied.scr

[Ford_Forgotton]

[ QUOTE ]

Return-path: &lt;jlester@thedieselstop.com&gt;

[/ QUOTE ]

That is the SPOOFED part of the address

[ QUOTE ]

Received: from mta25.srv.hcvlny.cv.net
(mta25.srv.hcvlny.cv.net [167.206.5.186]) by mstr8.srv.hcvlny.cv.net
(iPlanet Messaging Server 5.2 HotFix 1.16 (built May 14 2003))
with ESMTP id &lt;0HUD00FE62V90L@mstr8.srv.hcvlny.cv.net&gt; for
99f350sd@optonline.net; Wed, 10 Mar 2004 08:01:58 -0500 (EST)
Received: from optonline.net (ip2.sbair.qtm.net [216.163.34.178])
by mta25.srv.hcvlny.cv.net
(iPlanet Messaging Server 5.2 HotFix 1.16 (built May 14 2003))
with ESMTP id &lt;0HUD00F9O2V7YS@mta25.srv.hcvlny.cv.net&gt;

[/ QUOTE ]

and that is the REAL sender. Somebody on a cable internet provider. CV.net is Cablevision. specifically, the computer that sent it should be 216.163.34.178. but TDS uses 216.98.78.245. Two completely different parts of the internet.

[ThomasT]

Not to be a jerk but the point of the post is telling you not to open it if you get it... Spoof or not...

And yes we got hit hard by NetSky last week... Talk about no fun.