anyone here understand email headers? - GoFuckYourself.com

Marcus · 04-19-2002, 12:48 PM

I want to know if someone is intentionally sending me virises. I got this email from "[email protected]" which is odd because I've never had any content with ab, so i dont think it's them.

Is this email really from them or someone in hong kong? I dont know how to read email headers. I am [email protected]:

Return-Path: [email protected]
Received: from rly-ip02.mx.aol.com (rly-ip02.mx.aol.com [152.163.225.160])
by eliteplanet.com (8.11.6/8.11.6) with ESMTP id g3JEGci28671
for <[email protected]>; Fri, 19 Apr 2002 07:16:40 -0700
Received: from logs-mtc-ta.proxy.aol.com (logs-mtc-ta.proxy.aol.com [64.12.105.5])
by rly-ip02.mx.aol.com (8.8.8/8.8.8/AOL-5.0.0)
with ESMTP id LAA04880 for <[email protected]>;
Fri, 19 Apr 2002 11:22:09 -0400 (EDT)
Received: from Pajextk (ACA87D64.ipt.aol.com [172.168.125.100])
by logs-mtc-ta.proxy.aol.com (8.10.0/8.10.0) with SMTP id g3JFCDL210141
for <[email protected]>; Fri, 19 Apr 2002 11:12:13 -0400 (EDT)
Date: Fri, 19 Apr 2002 11:12:13 -0400 (EDT)
Message-Id: <[email protected]>
From: advertising <[email protected]>
To: [email protected]
Subject: Noresize
MIME-Version: 1.0
Content-Type: multipart/alternative;
boundary=XTvo8d4g299719Q790l9
X-Apparently-From: [email protected]
X-Mozilla-Status: 8001
X-Mozilla-Status2: 00000000
X-UIDL: D-Z"!_RR!!#Si"!(c~!!

--XTvo8d4g299719Q790l9
Content-Type: text/html;
Content-Transfer-Encoding: quoted-printable

HTML HEAD /HEAD BODY
iframe src=3Dcid:S6Q9v8Q2K6405 height=3D0 width=3D0>
iframe
FONT /FONT /BODY /HTML

kmanrox · 04-19-2002, 12:51 PM

depends what the message said... post the message... as their first assistant webmaster i can tell you if they'd email you something like that...

Marcus · 04-19-2002, 12:53 PM

the message is blank.

The souce of the message is TONS of text, heres the top part of it:

TVqQAAMAAAAEAAAA//8AALgAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAA
AAAAAAAA2AAAAA4fug4AtAnNIbgBTM0hVGhpcyBwcm9ncmFtIG Nhbm5vdCBiZSBydW4gaW4g
RE9TIG1vZGUuDQ0KJAAAAAAAAAAYmX3gXPgTs1z4E7Nc+BOzJ+ Qfs1j4E7Pf5B2zT/gTs7Tn
GbNm+BOzPucAs1X4E7Nc+BKzJfgTs7TnGLNO+BOz5P4Vs134E7 NSaWNoXPgTswAAAAAAAAAA
UEUAAEwBBAC4jrc8AAAAAAAAAADgAA8BCwEGAADAAAAAkAgAAA AAAFiEAAAAEAAAANAAAAAA
QAAAEAAAABAAAAQAAAAAAAAABAAAAAAAAAAAYAkAABAAAAAAAA ACAAAAAAAQAAAQAAAAABAA
ABAAAAAAAAAQAAAAAAAAAAAAAAAg1gAAZAAAAABQCQAQAAAAAA AAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAA
ANAAAOwBAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAudGV4dA AAAEq6AAAAEAAAAMAAAAAQ
AAAAAAAAAAAAAAAAAAAgAABgLnJkYXRhAAAiEAAAANAAAAAgAA AA0AAAAAAAAAAAAAAAAAAA
QAAAQC5kYXRhAAAAbF4IAADwAAAAUAAAAPAAAAAAAAAAAAAAAA AAAEAAAMAucnNyYwAAABAA
AAAAUAkAEAAAAABAAQAAAAAAAAAAAAAAAABAAABAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAA

Gramma · 04-19-2002, 12:56 PM

Not sure if this is the case here.. But I've received some emails as 'undeliverable' to my own email address that I never sent out. They are a result of someone's system being infected with a virus .. W32.Klez.e

This W32/Klez variant has the ability to spoof the email from field. The senders address used by the virus, is one that was found on the infected user's system. Thus, it may appear that you have received this virus from one person, when it was actually sent from a different user's system. Viewing the entire email header will display the actual senders address.

The virus can also send mails with empty Subject and/or body.

This virus can also unload several antivirus programs from memory

Info on the worm

Theo · 04-19-2002, 12:59 PM

hm,maybe their system is infected with w32.klez.h
brand new virus that hits like mad the last 2 days

http://[email protected]

Theo · 04-19-2002, 01:03 PM

hehe, we did same post gramma

my system got infected yesterday and i had to manually remove the virus since it destroys all antivirus that are installed in the system. Fucking bad luck. Second time a virus hits me in 2 months period.

Pathfinder · 04-19-2002, 04:30 PM

I have received several of them today. Norton antivirus has caught all of them so far.

04-19-2002, 12:48 PM	#1
Marcus Confirmed User Industry Role: Join Date: Jul 2001 Posts: 3,472	anyone here understand email headers? I want to know if someone is intentionally sending me virises. I got this email from "[email protected]" which is odd because I've never had any content with ab, so i dont think it's them. Is this email really from them or someone in hong kong? I dont know how to read email headers. I am [email protected]: Return-Path: [email protected] Received: from rly-ip02.mx.aol.com (rly-ip02.mx.aol.com [152.163.225.160]) by eliteplanet.com (8.11.6/8.11.6) with ESMTP id g3JEGci28671 for <[email protected]>; Fri, 19 Apr 2002 07:16:40 -0700 Received: from logs-mtc-ta.proxy.aol.com (logs-mtc-ta.proxy.aol.com [64.12.105.5]) by rly-ip02.mx.aol.com (8.8.8/8.8.8/AOL-5.0.0) with ESMTP id LAA04880 for <[email protected]>; Fri, 19 Apr 2002 11:22:09 -0400 (EDT) Received: from Pajextk (ACA87D64.ipt.aol.com [172.168.125.100]) by logs-mtc-ta.proxy.aol.com (8.10.0/8.10.0) with SMTP id g3JFCDL210141 for <[email protected]>; Fri, 19 Apr 2002 11:12:13 -0400 (EDT) Date: Fri, 19 Apr 2002 11:12:13 -0400 (EDT) Message-Id: <[email protected]> From: advertising <[email protected]> To: [email protected] Subject: Noresize MIME-Version: 1.0 Content-Type: multipart/alternative; boundary=XTvo8d4g299719Q790l9 X-Apparently-From: [email protected] X-Mozilla-Status: 8001 X-Mozilla-Status2: 00000000 X-UIDL: D-Z"!_RR!!#Si"!(c~!! --XTvo8d4g299719Q790l9 Content-Type: text/html; Content-Transfer-Encoding: quoted-printable HTML HEAD /HEAD BODY iframe src=3Dcid:S6Q9v8Q2K6405 height=3D0 width=3D0> iframe FONT /FONT /BODY /HTML Last edited by Marcus; 04-19-2002 at 12:51 PM..

04-19-2002, 12:51 PM	#2
kmanrox aka K-Man Industry Role: Join Date: Oct 2001 Location: The Gutter Posts: 29,290	depends what the message said... post the message... as their first assistant webmaster i can tell you if they'd email you something like that... __________________ Crypto HODLr Crypto mining Angel investor

04-19-2002, 12:56 PM	#4
Gramma Confirmed User Join Date: Apr 2002 Posts: 402	Not sure if this is the case here.. But I've received some emails as 'undeliverable' to my own email address that I never sent out. They are a result of someone's system being infected with a virus .. W32.Klez.e This W32/Klez variant has the ability to spoof the email from field. The senders address used by the virus, is one that was found on the infected user's system. Thus, it may appear that you have received this virus from one person, when it was actually sent from a different user's system. Viewing the entire email header will display the actual senders address. The virus can also send mails with empty Subject and/or body. This virus can also unload several antivirus programs from memory Info on the worm __________________ gramma at ix.netcom.com

04-19-2002, 12:53 PM	#3
Marcus Confirmed User Industry Role: Join Date: Jul 2001 Posts: 3,472	the message is blank. The souce of the message is TONS of text, heres the top part of it: TVqQAAMAAAAEAAAA//8AALgAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAA AAAAAAAA2AAAAA4fug4AtAnNIbgBTM0hVGhpcyBwcm9ncmFtIG Nhbm5vdCBiZSBydW4gaW4g RE9TIG1vZGUuDQ0KJAAAAAAAAAAYmX3gXPgTs1z4E7Nc+BOzJ+ Qfs1j4E7Pf5B2zT/gTs7Tn GbNm+BOzPucAs1X4E7Nc+BKzJfgTs7TnGLNO+BOz5P4Vs134E7 NSaWNoXPgTswAAAAAAAAAA UEUAAEwBBAC4jrc8AAAAAAAAAADgAA8BCwEGAADAAAAAkAgAAA AAAFiEAAAAEAAAANAAAAAA QAAAEAAAABAAAAQAAAAAAAAABAAAAAAAAAAAYAkAABAAAAAAAA ACAAAAAAAQAAAQAAAAABAA ABAAAAAAAAAQAAAAAAAAAAAAAAAg1gAAZAAAAABQCQAQAAAAAA AAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAA ANAAAOwBAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAudGV4dA AAAEq6AAAAEAAAAMAAAAAQ AAAAAAAAAAAAAAAAAAAgAABgLnJkYXRhAAAiEAAAANAAAAAgAA AA0AAAAAAAAAAAAAAAAAAA QAAAQC5kYXRhAAAAbF4IAADwAAAAUAAAAPAAAAAAAAAAAAAAAA AAAEAAAMAucnNyYwAAABAA AAAAUAkAEAAAAABAAQAAAAAAAAAAAAAAAABAAABAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAA

04-19-2002, 12:59 PM	#5
Theo HAL 9000 Industry Role: Join Date: May 2001 Posts: 34,515	hm,maybe their system is infected with w32.klez.h brand new virus that hits like mad the last 2 days http://[email protected]

04-19-2002, 01:03 PM	#6
Theo HAL 9000 Industry Role: Join Date: May 2001 Posts: 34,515	hehe, we did same post gramma my system got infected yesterday and i had to manually remove the virus since it destroys all antivirus that are installed in the system. Fucking bad luck. Second time a virus hits me in 2 months period.

04-19-2002, 04:30 PM	#7
Pathfinder theking of trailer parks Industry Role: Join Date: Sep 2001 Location: Tehachapi, California Posts: 2,277	I have received several of them today. Norton antivirus has caught all of them so far.