[WBEL-users] Possible Virus Problem

Thu, 29 Apr 2004 17:06:12 -0500

--=-2tR1VxLwd4eugzyZwqDn
Content-Type: text/plain
Content-Transfer-Encoding: 7bit

On Thu, 2004-04-29 at 10:30, Phil Schaffner wrote:

> Got an apparently spoofed email this AM that appeared to come from
> 
>  "Whitebox-users <whitebox-users@beau.org>"
> 
> and was addressed to my e-mail address as used on the list.  The title
> was "Encrypted document" and the message was blank with an attachment
> named "Information.vbs" - apparently a Visual Basic file.  Saved it and
> scanned with latest Norton AntiVirus definitions under Windoze which
> reported no infection.  Beware if you are reading mail under Windows and
> get something addressed to you from the list.
> 
> Phil

Thanks for the info Phil.

Lots of the new worms will spoof the FROM e-mail address, so they look
like they are from someone, when in fact, they are not.

If you look at the from address of actual mail in the list ... it is
FROM the real sender and TO the list ... so mail FROM the list and TO
you should be a dead give away that it is not real...

--=-2tR1VxLwd4eugzyZwqDn
Content-Type: text/html; charset=utf-8
Content-Transfer-Encoding: 7bit

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 TRANSITIONAL//EN">
<HTML>
<HEAD>
  <META HTTP-EQUIV="Content-Type" CONTENT="text/html; CHARSET=UTF-8">
  <META NAME="GENERATOR" CONTENT="GtkHTML/3.0.9">
</HEAD>
<BODY>
On Thu, 2004-04-29 at 10:30, Phil Schaffner wrote:
<BLOCKQUOTE TYPE=CITE>
<PRE><FONT COLOR="#737373"><I>Got an apparently spoofed email this AM that appeared to come from

 &quot;Whitebox-users &lt;whitebox-users@beau.org&gt;&quot;

and was addressed to my e-mail address as used on the list.  The title
was &quot;Encrypted document&quot; and the message was blank with an attachment
named &quot;Information.vbs&quot; - apparently a Visual Basic file.  Saved it and
scanned with latest Norton AntiVirus definitions under Windoze which
reported no infection.  Beware if you are reading mail under Windows and
get something addressed to you from the list.

Phil</PRE>
</BLOCKQUOTE>
Thanks for the info Phil. 
 
Lots of the new worms will spoof the FROM e-mail address, so they look like they are from someone, when in fact, they are not. 
 
If you look at the from address of actual mail in the list ... it is FROM the real sender and TO the list ... so mail FROM the list and TO you should be a dead give away that it is not real...
</BODY>
</HTML>

--=-2tR1VxLwd4eugzyZwqDn--