[aclug-L] Re: WeatherLab virus

["Arnold Cavazos Jr." <abcjr@xxxxxxxxx>]

David,

You _are_ wrong,  "southwind.net" is still a valid e-mail domain:

***
abcjr@corp:~<--% host -t mx southwind.net
southwind.net mail is handled by 5 onemain-mx.earthlink.net.
***

ELNK is just not creating any more "southwind.net" e-mail accounts.

--
Arnold B. Cavazos, Jr.                           Voice:  (316)858-3000
Director of Operations                             Fax:  (316)858-3001
Hubris Communications                        Toll-Free:  (866)267-INET
abcjr@xxxxxxxxxx   http://www.iwichita.com    http://www.dslkansas.net


On Thu, Nov 14, 2002 at 10:04:25AM -0600, David Carmichael wrote:
> 
> Kevin -
> 
> While I did not see the "Southwind" header.. I was mainly trying to let you
> know that somebody was sending out / spoofing emails with WeatherLab as the
> FROM.
> 
> This way you are informed and might be able to help track down and or alert
> others of the fake emails.
> 
> What is strange is.. maybe I am wrong here... but I did not even know that
> "Southwind" was still a good email address due to the number of mergers with
> other companies over the past few years?
> 
> --David
> 
> ----- Original Message -----
> From: "Kevin White" <kevin@xxxxxxx>
> To: <dec2955@xxxxxxxxxx>
> Sent: Thursday, November 14, 2002 9:43 AM
> Subject: WeatherLab virus
> 
> 
> Hi David,
> 
> I got your fax about the virus you received from the KSN WeatherLab.  I see
> by the headers that you didn't really receive it from the WeatherLab,
> however.  It came from a Southwind dial-up account in Hutchinson.  You can
> tell by looking at the first "Received:" line (they go in order from the
> "From:" up.  The first received line listed is the last place the email
> routed through.
> 
> This is caused by the fact that some user with Southwind received the virus
> through their Outlook email software.  This virus then sends the virus out
> AS everyone listed in their address book.  Therefore, it claims to come from
> the weatherlab, but it's only using an email address it found in the
> infected users address book.
> 
> Unfortunately, there is absolutely nothing we can do about it because it
> doesn't come from or through any of our machines.  It claims that it does,
> but it doesn't.  The headers always tell the story.
> 
> Kevin White
> KSN New Media Manager
> 
> 
> 
> -- This is the discussion@xxxxxxxxx list.  To unsubscribe,
> visit http://www.complete.org/cgi-bin/listargate-aclug.cgi
> 

-- 
Arnold B. Cavazos, Jr.                           Voice:  (316)858-3000
Director of Sales & Marketing                      Fax:  (316)858-3001
Hubris Communications                        Toll-Free:  (866)267-INET
abcjr@xxxxxxxxxx   http://www.iwichita.com    http://www.dslkansas.net

-- This is the discussion@xxxxxxxxx list.  To unsubscribe,
visit http://www.complete.org/cgi-bin/listargate-aclug.cgi