I have received an e-mail from someone claiming to be MarkG, containing a virus

[Asmodean]

Did anyone else receive this?

The e-mail is from "markg" written like that, e.g. with no capitals. And it has the following subject: "re:asmodean,look,my beautiful girl friend" again with no capitals.

It contained the virus: W32.Klez.H@mm

This is indeed weird. Either it is a worm, automatically sent from Mark's Apolyton adress, or someone knows that I am a 'poly member, and sends an e-mail claiming to be Mark.

Either way, Norton Antivirus blocked it, so nothing happened.

Asmodean

[Inverse Icarus]

thanks for the heads up. the promise of greek chicks will be a warning.

[Wittlich]

Either Mark has gotten infected or someone from Apolyton is out to get you Asmodean.

Asmodean, have you made any enemies on Apolyton lately?

Either way, thank God for Norton!

[GhengisFarb™]

Originally posted by Wittlich
Asmodean, have you made any enemies on Apolyton lately?

Maybe MarkG is out to get him...........

[Rasbelin]

Just check the full header of the message for the SMTP server which sent it (should contain apolyton.net) and also notice that messages sent by Markos are labeled "Markos Giannopoulos" as sender.

[Asmodean]

Oh yeah...I forgot to add that the sender adress was markg@apolyton.net.

That is Mark's Apolyton adress, isn't it?

Asmodean

[Asmodean]

Originally posted by Asuka
Just check the full header of the message for the SMTP server which sent it (should contain apolyton.net) and also notice that messages sent by Markos are labeled "Markos Giannopoulos" as sender.

Are you sure of that, Asuka. I have never received an e-mail from Mark before. Also, can an SMTP header be spoofed? 'Cause it sure is from Apolyton.net

Asmodean

[Asmodean]

I was able to extract the following from the e-mail:

X-Symantec-TimeoutProtection: 0
X-Symantec-TimeoutProtection: 1
Return-Path: JTAYLOR256@comcast.net
Received: from rwcrmhc12.comcast.net ([216.148.227.85])
          by fepX.post.tele.dk
          (InterMail vM.5.01.06.05 201-253-122-130-105-20030824) with ESMTP
          id <20030927135738.OPPO12852.fepX.post.tele.dk@rwcrmhc12.comcast.net>
          for ; Sat, 27 Sep 2003 15:57:38 +0200
Date: Sat, 27 Sep 2003 13:57:29 +0000 (GMT)
X-Comment: Sending client does not conform to RFC822 minimum requirements
X-Comment: Date has been added by Maillennium.
Received: from Kvxm (pcp03463143pcs.indpnd01.mo.comcast.net[68.86.43.63])
          by comcast.net (rwcrmhc12) with SMTP
          id <2003092713572701400f9pkae>; Sat, 27 Sep 2003 13:57:27 +0000
From: markg 
To: asmodean@xxxxxxxx.dk
Subject: Re:asmodean,look,my beautiful girl friend
MIME-Version: 1.0
Content-Type: multipart/alternative;
	boundary=U881k0iHXu4qfKf36239847H1
Message-Id: <20030927135738.OPPO12852.fepX.post.tele.dk@rwcrmhc12.comcast.net>

So who is JTAYLOR256@comcast.net ??

Asmodean

[Gramphos]

And advance webcrawler bot for spam mail sendings could be possible.

[MarkG]

the "from" field is by no means a very safe way to judge the real sender of a mail

[Asmodean]

I am aware of that, Mark. Or I have become aware tonight

Could you check, or have Dan check, if the sender JTAYLOR256@COMCAST.NET is an Apolyton member, and if so give him a slap on the wrist

Asmodean

[geeslaka]

Seems like a slap on the face would be more in order. Preferably with a heavy blunt object.

[Asmodean]

Originally posted by Gramphos
And advance webcrawler bot for spam mail sendings could be possible.

I don't think so, Gramphos.

That would require my e-mail addy to be "out there" which it is definately not. I am extremely precautious with whom I give this e-mail addy.

Plus there are too many coincidences. I am an Apolyton member, and the mail came from MarkG. How would a webcrawler bot ever find that information, and link it to my e-mail adress?

Asmodean

[MarkG]

Originally posted by Asmodean
Could you check, or have Dan check, if the sender JTAYLOR256@COMCAST.NET is an Apolyton member, and if so give him a slap on the wrist

it's almost certain that it's not....

[Asmodean]

I know, Mark. But this has kinda freaked me out a bit. I have reported the incident to the ISP that is behind that e-mail addy. We'll see where that leads. If this person truly wanted to hide, he'd have used a hotmail account.

He didn't. That adress is from a regular ISP account. I hope that proves to be a costly mistake.

Asmodean

[MarkG]

Originally posted by Asmodean
That would require my e-mail addy to be "out there" which it is definately not. I am extremely precautious with whom I give this e-mail addy.

i've not put my imarton.net address anywhere public and yet i've recieved spam on it....

btw, viruses are usually transferred without the knowledge of the sender...

[Asmodean]

Originally posted by MarkG
btw, viruses are usually transferred without the knowledge of the sender...

I know, Mark.

It's the MarkG thing that makes me wonder if this case is different. But of course, I may be wrong

Asmodean

[Wittlich]

Intiguing to say the least. Asmodean, let us know what you find out from the ISP.

[Rasbelin]

Originally posted by Asmodean

Are you sure of that, Asuka.

Yes, I am. Why? I have received e-mail from the real Mr. Giannopoulos.

Also, can an SMTP header be spoofed?

AFAIK nope.

Markos,

indeed, but sure you know at least to be aware that something isn't like usually if the sender uses a different name. Of course checking the header will do it.

And that person appears to be a Comcast cable modem user somewhere in Missouri, USA (possibly St. Louis).

[alva]

Seeing there are 40.000 members, this could be all just be pure chance...

But strange it is indeed.

[Frozzy]

Originally posted by Asmodean
It's the MarkG thing that makes me wonder if this case is different. But of course, I may be wrong

Bot alert! It could be that the bot located your address on apolyton (either in the data or on the site), and "markg", and lo and behold...

I'm thinking a bot.

[Gatekeeper]

Bah. I get an occasional e-mail to one of my Yahoo accounts that's allegedly from "Microsoft Security," and insists that I use the attached "patch" immediately because there are "more than 500,000 viruses out there."

First of all, I'm on a Macintosh. Second of all, I really, really doubt Microsoft — which doesn't send security patches via e-mail in the first place — has an origination point that's somewhere in Russia!

What the hell do they take us for? Idiots?

Gatekeeper

[geeslaka]

90% of humans are idiots.

[Nubclear]

I like to keep samples of the viruses I get.

[Wittlich]

that is just un-natural Tassadar...also a little bit worrisome!

[geeslaka]

Building an arsenal Tass? Be warned, viruses may be declared weapons of mass destruction....

[Urban Ranger]

This is the information I found on the W32.Klez.H@mm. Apparently McAFee classifies it as a worm, and the .H variant seems to be the most successful one.

[Tassadar500]

When I am in my Apolyton e-mail I recieve countless e-mails from admin@apolyton.net that contain viruses.

[notyoueither]

Originally posted by Asmodean
That would require my e-mail addy to be "out there" which it is definately not. I am extremely precautious with whom I give this e-mail addy.

It's 'out there' now, since it is contained in the header you posted; unless you modified that bit, of course...

[Asmodean]

Bah...I missed that one. Thanks nye. Modified now

Asmodean