29 Nov
2001
29 Nov
'01
3:03 a.m.
S. Ring, IIRC, is Stephanie Ring. She is/was a list member.
I'm using Outlook 2000 with the latest Microslop patches/security updates
and the latest version of ZoneAlarm, 2.6.357, so I avoided infection.
Since the attachment was quarantined, the email I received has a seemingly
blank body and no apparent attachment. The subject line is:
Re: RE: SWTPc and Microdata (WARNING - LONG EMAIL STILL),
which is a reply to an email I sent over a year ago to Jay West (hello,
Jay), which he replied to by sending a new email with a different subject
line. I'm guessing that Jay still had my original unreplied to email?
Checking the properties of the this email does show "size: 30KB (Contains 1
included file(s))".
And, here's the header from the email, however I xz-munged the email
addresses. Note the underscore in the "From:":
Return-Path: <xwest(a)xtseinc.com>
Received: from opal.tseinc.com (opal.tseinc.com [209.83.143.19])
by mlynk.com (8.9.3/8.9.3) with ESMTP id VAA14949
for <zwhdawson(a)mlynkz.com>om>; Wed, 28 Nov 2001 21:59:38 -0500
Received: from aol.com (user(a)stl-26.tseinc.com [209.83.137.26])
by opal.tseinc.com (8.9.3/8.9.3) with SMTP id TAA73484
for <zwhdawson(a)mlynkz.com>om>; Wed, 28 Nov 2001 19:36:03 -0600 (CST)
(envelope-from xwest(a)xtseinc.com)
Date: Wed, 28 Nov 2001 19:36:03 -0600 (CST)
Message-Id: <200111290136.TAA73484(a)opal.tseinc.com>
From: "Jay West" <_xwest(a)xtseinc.com>
To: zwhdawson(a)mlynkz.com
Subject: Re: RE: SWTPc and Microdata (WARNING - LONG EMAIL STILL)
MIME-Version: 1.0
Content-Type: multipart/related;
type="multipart/alternative";
boundary="====_ABC1234567890DEF_===="
X-Priority: 3
X-MSMail-Priority: Normal
X-Unsent: 1
Status:
My sister wasn't so lucky in avoiding the hit, so I'll have to go clean up
her system. The infected email in her case came from an eBay user. BTW,
FWIW, S. Ring is or was an eBay member.
'til next time,
Bill
-> On Wed, Nov 28, 2001 at 03:36:25PM -0800, Fred Cisin (XenoSoft) wrote:
-> > This one, the "payload" was in:
-> > README.mp3.scr
-> > I've also gotten earlier today from other mails a couple with a payload
-> > named:
-> > SM3SONG.mp3.scr