Rockbox.org home
release
dev builds
extras
themes manual
wiki
device status forums
mailing lists
IRC bugs
patches
dev guide



Rockbox mail archive

Subject: Re: mydoom.A2 on the List
From: Fred Maxwell (rockbox_at_anti-spam.org)
Date: 2004-02-09


Actually, it's stranger than that. It will take random domains and pair
them up with random user names. So if your address book has bob_at_aol.com
and susan_at_earthlink.net, Mydoom will send mail to bob_at_aol.com,
bob_at_earthlink.net, susan_at_aol.com, and susan_at_earthlink.net -- as well as
forging e-mail from all of the above actual and concocted addresses.

Regards,
  Fred Maxwell

David McIntyre wrote:

>If that were true, Mydoom.a would be infecting machines that were not able to
>execute it, as in my case, where I'm getting bounces from my resume' email
>address which is a receive-only box with no client configured to send mail from
>that addr. Quite the trick.
>No, the trick of this worm is to hijack a person's outlook address book and
>forge mail from every address in the list.
>
>On Sat, Feb 07, 2004 at 12:49:15PM +0100, Paul Arnst wrote:
>
>
>>that is the trick of the new virus which makes you belive that an email
>>could not be delivered !!!
>>virus is the attachment !!!
>>
>>paul arnst
>>
>>----- Original Message -----
>>From: "Dario Carluccio" <rockbox_list_at_carluccio.de>
>>To: <rockbox_at_cool.haxx.se>
>>Sent: Saturday, February 07, 2004 11:51 AM
>>Subject: mydoom.A2 on the List
>>
>>
>>
>>
>>>Hello Rockbox, Hello Rockboxers,
>>>
>>>Perhaps someone on this list is infected with mydoom.A2! [1]
>>>
>>>And this mydoom found my address on his PC and is now sending mails
>>>with my sender-address.
>>>
>>>So someone will have this address george_at_cubaautrement.com in some file
>>>on his PC and my address too. BTW: This address doesn't exist anymore.
>>>
>>>And properly this is the person, which is infected with mydoom.
>>>
>>>So please take care and/or use better e-mail clients,
>>>and remove your virus.
>>>
>>>Here is a part of the header of the Mail, which returned to me,
>>>because this address isn't valid anymore.
>>>
>>>
>>>,----- [ mid:200402061640.i16Geojw015733_at_ns1.icc-canada.com ]
>>>| Reporting-MTA: dns; ns1.icc-canada.com
>>>| Received-From-MTA: DNS; ABayonne-105-1-20-8.w81-250.abo.wanadoo.fr
>>>| Final-Recipient: RFC822; george_at_cubaautrement.com
>>>| Diagnostic-Code: SMTP; 550 <george_at_cubaautrement.com>, Recipient unknown
>>>|
>>>| [...]
>>>|
>>>| --i16Geojw015733.1076085650/ns1.icc-canada.com
>>>| Content-Type: message/rfc822
>>>|
>>>| Return-Path: <rockbox_list_at_carluccio.de>
>>>| Message-Id: <200402061640.i16GeGjw015728_at_ns1.icc-canada.com>
>>>| From: rockbox_list_at_carluccio.de
>>>| To: george_at_cubaautrement.com
>>>| Subject: test
>>>| Date: Fri, 6 Feb 2004 17:39:43 +0100
>>>|
>>>| [...]
>>>|
>>>| ------=_NextPart_000_0003_5AAE1ACF.E8BC8F9D
>>>| Content-Type: application/octet-stream;
>>>| name="text.zip"
>>>| Content-Transfer-Encoding: base64
>>>| Content-Disposition: attachment;
>>>| filename="text.zip"
>>>|
>>>| [...]
>>>`-----
>>>
>>>bye
>>> Dario
>>>
>>>[1] http://www.symantec.com/avcenter/venc/data/w32.novarg.a_at_mm.html
>>>--
>>>NO SIG
>>>
>>>_______________________________________________
>>>http://cool.haxx.se/mailman/listinfo/rockbox
>>>
>>>
>>>
>>_______________________________________________
>>http://cool.haxx.se/mailman/listinfo/rockbox
>>
>>
>
>
>

_______________________________________________
http://cool.haxx.se/mailman/listinfo/rockbox



Page was last modified "Jan 10 2012" The Rockbox Crew
aaa