. : | E-mail Address For Virus Sender | : .

Printable View

10-02-2003, 12:10 AM
KazaaBoy

As I said before in another topic that once someone sent me a virus and all it had in the return path was this " <> "

Now they sent it again and this time the address is different. Check it out

Code:

Return-Path: <[email protected]> Delivered-To: [email protected] Received: (qmail 22098 invoked from network); 1 Oct 2003 22:00:15 -0000 Received: from turkey.mail.pas.earthlink.net (207.217.120.126)  by 0 with SMTP; 1 Oct 2003 22:00:15 -0000 Received: from dialup-171.75.7.35.dial1.phoenix1.level3.net ([171.75.7.35] helo=vhlof) by turkey.mail.pas.earthlink.net with smtp (Exim 3.33 #1) id 1A4ow1-000510-00; Wed, 01 Oct 2003 14:55:02 -0700 FROM: "Security Support" <[email protected]> TO: "Microsoft Customer" <[email protected]> SUBJECT:   Mime-Version: 1.0 Content-Type: multipart/mixed; boundary="dlntrravlhho" Message-Id: <[email protected]> Date: Wed, 01 Oct 2003 14:55:02 -0700

I changed the Delivered-To: [email protected] to protect my e-mail address from spammers when reading this post.

What do you all think and how can I trace this person down.
10-02-2003, 12:11 AM
Wolfmight

just goto symatec security response website.. they got info on all viruses
10-02-2003, 12:13 AM
ultimatejester

he/she probably used telnet or sumother program that sends fake emails (email bomber)
10-02-2003, 12:38 AM
fkdup74

:lol: :lol: :lol: send it back! send it back! :lol: :lol: :lol:
10-02-2003, 12:47 AM
ultimatejester

Quote:

Originally posted by FKDUP74@2 October 2003 - 00:38
:lol: :lol: :lol: send it back! send it back! :lol: :lol: :lol:

he cant send it back. that email address doesnt exist ;)
10-02-2003, 12:47 AM
KazaaBoy

Quote:

Originally posted by FKDUP74@2 October 2003 - 00:38
:lol: :lol: :lol: send it back! send it back! :lol: :lol: :lol:

:lol: :lol: I would have to go down to their level and and act like a buffoon. I have seen a program that send e-mail and allows you to send a fake e-mail with an attchment and allows you to type a fake address as the return path.

This virus forced it's self to download on my computer. I didn't click the download button or even check the e-mail.
10-02-2003, 12:54 AM
Wolfmight

Quote:

Originally posted by KazaaBoy+1 October 2003 - 18:47--></div><table border='0' align='center' width='95%' cellpadding='3' cellspacing='1'><tr><td>QUOTE (KazaaBoy @ 1 October 2003 - 18:47)</td></tr><tr><td id='QUOTE'> <!--QuoteBegin-FKDUP74@2 October 2003 - 00:38
:lol:  :lol:  :lol:  send it back! send it back!  :lol:  :lol:  :lol:

:lol: :lol: I would have to go down to their level and and act like a buffoon. I have seen a program that send e-mail and allows you to send a fake e-mail with an attchment and allows you to type a fake address as the return path.

This virus forced it's self to download on my computer. I didn't click the download button or even check the e-mail. [/b][/quote]
yea, then kazaaboy would become the culprit
10-02-2003, 01:11 AM
balamm

There's your return path >>

Quote:

FROM: "Security Support" <[email protected]>
TO: "Microsoft Customer" <[email protected]>

It's likely not real or it's an unidentifiable localhost ID. You could try "finger" but it's unlikely you'll get real results. YourISP should really provide better info on this. This looks weak. I got several pages of network info on the same email and it was tracked very successfully back to some romanian kid in the early days. Now it's widespread.
As for sending it back, why? the virus is just going to add you and all your contacts back into it's DB for more mailings.
Ignore it, don't even let it know you exist. Chances are, if you opened on of these viruses already, then your system has also sent the virus attachments on and someone is looking for you as well.

Instead, go into your tools and options menus. Create a new blocked sender rule where person "<>" is blocked from your email client and all messages containing this sender address are deleted from the server. You can do that with a number o known exploits. The same as spam filters do. Removed quoted subject lines as well and have them moved to a temp folder because they're likely to be mass mailed junk.

There's some reg keys that will prevent these attachments from being able to execute. No extensions means no execute. It was posted here a month or two ago.
10-02-2003, 01:23 AM
sparsely

I'm sure there's somebody you can sue over this...

:rolleyes:
10-02-2003, 01:33 AM
Wolfmight

hard to tho.. they hide they're real identity
10-02-2003, 11:28 AM
Cl1mh4224rd

Believe me, KazaaBoy... No one's specifically targetting you. Everyone gets these damn things every once in a while.
10-02-2003, 02:59 PM
exeus

hi i think your best bet is to send an email to here "[email protected]" send em the header source or just attach the entire email and tell them what happened.....
10-02-2003, 03:05 PM
fkdup74

Quote:

Originally posted by ultimatejester+1 October 2003 - 16:47--></div><table border='0' align='center' width='95%' cellpadding='3' cellspacing='1'><tr><td>QUOTE (ultimatejester @ 1 October 2003 - 16:47)</td></tr><tr><td id='QUOTE'> <!--QuoteBegin-FKDUP74@2 October 2003 - 00:38
:lol: :lol: :lol: send it back! send it back! :lol: :lol: :lol:

he cant send it back. that email address doesnt exist ;) [/b][/quote]
it was just a joke guys :P
read my sig :D
10-02-2003, 08:34 PM
KazaaBoy

Thanks for everyone that replied. I thought I was the only one receiving it.