Skip to Content.
Sympa Menu

internetworkers - Re: Help! I've been abused!

internetworkers AT lists.ibiblio.org

Subject: Internetworkers: http://www.ibiblio.org/internetworkers/

List archive

Chronological Thread  
  • From: <beeline AT mindspring.com>
  • To: InterNetWorkers <internetworkers AT franklin.metalab.unc.edu>
  • Subject: Re: Help! I've been abused!
  • Date: Thu, 20 Jun 2002 10:41:27 -0400


None of these email addresses are in my address book or would be in the
(primarily news site) pages that I visit. The message is sex site spam and
links to a real site (although whois doesn't recognize the site location). I
have a current v of Norton Antivirus working for me. None of my friends have
contacted me with expressions of !!! because I sent them a sex site spam. I do
not think this is a virus. Surely there is something that I can do about this
since it is a form of identity theft? At the least I should be able to get the
advertised site shut down.



On Thu, 20 Jun 2002 14:04:18 +0000 "Josep L. Guallar-Esteve"
<jlguallar AT maduixa.net> wrote:



El dia Dijous 20 Juny 2002 03:05, no tenies res mes que fer i vas i m'envies

aquest e-mail:

> Talk about makin' a body real mad.... It's happened again! I'm getting a

> slew of failed mail notifications because some spam [nasty] has

> appropriated my e-mail address! I reported it to the Mindspring/Earthlink

> abuse desk, but don't know if they can/will do anything (I sent a copy of

> the full text of one of the 30 failure notifications).... Anyone have any

> further ideas? I do have the failure notifications, some of which include

> an attachment of the filthy spam....





Are you sure is someone taking over your identity for spam pouropses?



The Klez virus has a behavious that, first, made me think that someone hasd

taken over my email address. Then, I learnt some more about Klez. Now I know

that it was the Klez virus.



How the Klez virus work?



First, infects someone



Then, checks for e-mail addresses in the addressbooks, cached-webpages, sent

messages, received messages, newsgroup messages (if you are into usenet)...



Now, the virus decides to use one of those collected email addresses as the

forged "From" field, to make more difficult to detect the infected machine.



The last step is the "reproduction": the virus sends itself to all the

collected e-mail addresse, using the "From" (and, I think, "Retrun-To")

field(s) forged so they point to someoneelses's adress.



So, when an infected email bounces, it bounces to an uninfected, unsuspecting

email address (the one used in the "From" field).



Of course, using the "Sender-IP" field you can verify that it was not you who

sent the email.



With some triangulation, SamSpade and a few friends, I was able to get to one

of my "Windows-friends" infected with the Klez viirus that was using my

e-mail address in the "From:" field.



Hope that this is your case.







Salut,

Josep

--

Josep L. Guallar-Esteve, QA-Test Engineer, Red Hat, Inc.

http://www.ibiblio.org/sinner/



---

Come and play at the InterNetWorkers Web site!
http://www.ibiblio.org/internetworkers/

You are currently subscribed to internetworkers as: beeline AT mindspring.com

To unsubscribe send a blank email to
$subst('Email.Unsub')






Archive powered by MHonArc 2.6.24.

Top of Page