I have received an e-mail from someone claiming to be MarkG, containing a virus

[Asmodean]

Did anyone else receive this?

The e-mail is from "markg" written like that, e.g. with no capitals. And it has the following subject: "re:asmodean,look,my beautiful girl friend" again with no capitals.

It contained the virus: W32.Klez.H@mm

This is indeed weird. Either it is a worm, automatically sent from Mark's Apolyton adress, or someone knows that I am a 'poly member, and sends an e-mail claiming to be Mark.

Either way, Norton Antivirus blocked it, so nothing happened.

Asmodean

[Inverse Icarus]

thanks for the heads up. the promise of greek chicks will be a warning.

[Wittlich]

Either Mark has gotten infected or someone from Apolyton is out to get you Asmodean.

Asmodean, have you made any enemies on Apolyton lately?

Either way, thank God for Norton!

[GhengisFarbâ„¢]

Originally posted by Wittlich
Asmodean, have you made any enemies on Apolyton lately?

Maybe MarkG is out to get him...........

[Rasbelin]

Just check the full header of the message for the SMTP server which sent it (should contain apolyton.net) and also notice that messages sent by Markos are labeled "Markos Giannopoulos" as sender.

[Asmodean]

Oh yeah...I forgot to add that the sender adress was markg@apolyton.net.

That is Mark's Apolyton adress, isn't it?

Asmodean

[Asmodean]

Originally posted by Asuka
Just check the full header of the message for the SMTP server which sent it (should contain apolyton.net) and also notice that messages sent by Markos are labeled "Markos Giannopoulos" as sender.

Are you sure of that, Asuka. I have never received an e-mail from Mark before. Also, can an SMTP header be spoofed? 'Cause it sure is from Apolyton.net

Asmodean

[Asmodean]

I was able to extract the following from the e-mail:

X-Symantec-TimeoutProtection: 0
X-Symantec-TimeoutProtection: 1
Return-Path: [email]JTAYLOR256@comcast.net[/email]
Received: from rwcrmhc12.comcast.net ([216.148.227.85])
          by fepX.post.tele.dk
          (InterMail vM.5.01.06.05 201-253-122-130-105-20030824) with ESMTP
          id <20030927135738.OPPO12852.fepX.post.tele.dk@rwcrmhc12.comcast.net>
          for ; Sat, 27 Sep 2003 15:57:38 +0200
Date: Sat, 27 Sep 2003 13:57:29 +0000 (GMT)
X-Comment: Sending client does not conform to RFC822 minimum requirements
X-Comment: Date has been added by Maillennium.
Received: from Kvxm (pcp03463143pcs.indpnd01.mo.comcast.net[68.86.43.63])
          by comcast.net (rwcrmhc12) with SMTP
          id <2003092713572701400f9pkae>; Sat, 27 Sep 2003 13:57:27 +0000
From: markg 
To: [email]asmodean@xxxxxxxx.dk[/email]
Subject: Re:asmodean,look,my beautiful girl friend
MIME-Version: 1.0
Content-Type: multipart/alternative;
	boundary=U881k0iHXu4qfKf36239847H1
Message-Id: <20030927135738.OPPO12852.fepX.post.tele.dk@rwcrmhc12.comcast.net>

So who is JTAYLOR256@comcast.net ??

Asmodean

[Gramphos]

And advance webcrawler bot for spam mail sendings could be possible.

[MarkG]

the "from" field is by no means a very safe way to judge the real sender of a mail

[Asmodean]

I am aware of that, Mark. Or I have become aware tonight

Could you check, or have Dan check, if the sender JTAYLOR256@COMCAST.NET is an Apolyton member, and if so give him a slap on the wrist

Asmodean

[geeslaka]

Seems like a slap on the face would be more in order. Preferably with a heavy blunt object.

[Asmodean]

Originally posted by Gramphos
And advance webcrawler bot for spam mail sendings could be possible.

I don't think so, Gramphos.

That would require my e-mail addy to be "out there" which it is definately not. I am extremely precautious with whom I give this e-mail addy.

Plus there are too many coincidences. I am an Apolyton member, and the mail came from MarkG. How would a webcrawler bot ever find that information, and link it to my e-mail adress?

Asmodean

[MarkG]

Originally posted by Asmodean
Could you check, or have Dan check, if the sender JTAYLOR256@COMCAST.NET is an Apolyton member, and if so give him a slap on the wrist

it's almost certain that it's not....

[Asmodean]

I know, Mark. But this has kinda freaked me out a bit. I have reported the incident to the ISP that is behind that e-mail addy. We'll see where that leads. If this person truly wanted to hide, he'd have used a hotmail account.

He didn't. That adress is from a regular ISP account. I hope that proves to be a costly mistake.

Asmodean