[aclug-L] Re: WeatherLab virus

["gLaNDix (Jesse Kaufman)" <glandix@xxxxxxxxxxxx>]

Lovely.  I remember when someone spoofed my e-mail address and caused me =
400+=20
mailer-daemon e-mails a day!

Yes, *@southwind.net is still a valid address.  Both Earthlink and OneMai=
n=20
kept them around so people didn't have to change their e-mail address aft=
er=20
the merger.  As of yesterday, my parents' southwind.net e-mail address st=
ill=20
works, but I really do not know how long they plan on keeping that featur=
e.

Jesse

On Thursday 14 November 2002 10:04 am, David Carmichael wrote:
> Kevin -
>
> While I did not see the "Southwind" header.. I was mainly trying to let=
 you
> know that somebody was sending out / spoofing emails with WeatherLab as=
 the
> FROM.
>
> This way you are informed and might be able to help track down and or a=
lert
> others of the fake emails.
>
> What is strange is.. maybe I am wrong here... but I did not even know t=
hat
> "Southwind" was still a good email address due to the number of mergers
> with other companies over the past few years?
>
> --David
>
> ----- Original Message -----
> From: "Kevin White" <kevin@xxxxxxx>
> To: <dec2955@xxxxxxxxxx>
> Sent: Thursday, November 14, 2002 9:43 AM
> Subject: WeatherLab virus
>
>
> Hi David,
>
> I got your fax about the virus you received from the KSN WeatherLab.  I=
 see
> by the headers that you didn't really receive it from the WeatherLab,
> however.  It came from a Southwind dial-up account in Hutchinson.  You =
can
> tell by looking at the first "Received:" line (they go in order from th=
e
> "From:" up.  The first received line listed is the last place the email
> routed through.
>
> This is caused by the fact that some user with Southwind received the v=
irus
> through their Outlook email software.  This virus then sends the virus =
out
> AS everyone listed in their address book.  Therefore, it claims to come
> from the weatherlab, but it's only using an email address it found in t=
he
> infected users address book.
>
> Unfortunately, there is absolutely nothing we can do about it because i=
t
> doesn't come from or through any of our machines.  It claims that it do=
es,
> but it doesn't.  The headers always tell the story.
>
> Kevin White
> KSN New Media Manager
>
>
>
> -- This is the discussion@xxxxxxxxx list.  To unsubscribe,
> visit http://www.complete.org/cgi-bin/listargate-aclug.cgi

-- This is the discussion@xxxxxxxxx list.  To unsubscribe,
visit http://www.complete.org/cgi-bin/listargate-aclug.cgi