[W124] price_20-Dec-2006

[Steve Nervig]

Well, Frank, I believe you when you say it had a virus payload  
attached. But, it was not sent from me or by me. It was sent from  
someone else's computer (an infected Windows computer; read my  
original message) that spoofed my email address and probably many  
other persons in the infected computer's Address book.

You can not look at a message header and assume that the message came  
from the person it says it came from (ie, the From: field). The  
spoofers can hack that field so as to make the messages appear from  
someone in YOUR address book or from someone who wrote a message that  
YOU read sometime in the past. They can even hack the Subject: field.  
These are all, unfortunately, exploits of the Windows operating  
system and Outlook.

BTW, I received no such message (the first W message) thru w124list  
coupes today. That message was, apparently, BOUNCED by the w124list  
back to you. It never made it *thru* the list and on to everyone  
else, if I am analyzing this correctly. That *suggests* that it  
actually came from your computer, but doesn't prove it. Which *might*  
mean that your computer is infected. But since you are using the  
Microsoft company's domain mail, that seems unlikely because I would  
assume that Microsoft has some pretty heavy anti-spam, anti-virus  
coporate controls working on your mail system. They would have to.

So the bottom line:
It did not come from me or any other Mac (there are no known Mac OS  
exploits in the wild *at this time*).
It did come from a computer running Windows, almost certainly.
And, unfortunately, almost certainly, you can't easily tell from who.

Regards,
Steve


On Dec 20, 2006, at 2:27 PM, Frank Smyth wrote:


> The email from dakota at mac.com sent earlier today to the W124 list  

> (with the abbreviation "W" in the email) has the Win32/Bagle.gen  

> virus embedded in a zip file entitled "new_price20-Dec-2006.zip"

>

> Cheers

> Frank

>

> -----Original Message-----

> From: w124list-bounces at mbcoupes.com [mailto:w124list- 

> bounces at mbcoupes.com] On Behalf Of Steve Nervig

> Sent: 20 December 2006 20:23

> To: W124 CE Coupes and Convertibles

> Subject: Re: [W124] price_20-Dec-2006

>

>

> On Wednesday, December 20, 2006, at 04:41AM, "Frank Smyth"  

> <Frank.Smyth at microsoft.com> wrote:

>> Virus-ridden spam.

>>

>> Can someone remove this guy from accessing the list ?

>>

>> From: w124list-bounces at mbcoupes.com [mailto:w124list- 

>> bounces at mbcoupes.com] On Behalf Of Dakota

>> Sent: 20 December 2006 05:43

>> To: W

>> Subject: [W124] price_20-Dec-2006

>>

>

>

> Not sure who you are referring to, Frank. The above short-form  

> header is a little vague, as it does not reveal a full address  

> (only "Dakota").

>

> My address is dakota at mac.com, so if it is me that you are trying to  

> indict, you are mistaken. I have a Macintosh, so I am pretty sure  

> that, a) it is not infected with a PeeCee virus, nor,  b) it is not  

> infected with any PeeCee trojan doing any spamming. This is, of  

> course, because I am not running the Microsoft operating system,  

> Windows.

>

> If only Microsoft could produce an operating system robust and  

> secure enough to limit this type of activity, we all would be  

> better off and not afflicted with the spam that proliferates the  

> email system today. Several BILLION messages are sent every day,  

> and 9 of every 10 messages, yes 90%!, are spam. And every single  

> one of those spam messages, EVERY ONE, is propagated from a  

> computer running the Windoze operating system.

>

> Regards,

> Steve

> ---

> drinking upstream from the herd

>

> _______________________________________________

> W124list mailing list

> W124list at mbcoupes.com

> http://www.pairlist.net/mailman/listinfo/w124list

> _______________________________________________

> W124list mailing list

> W124list at mbcoupes.com

> http://www.pairlist.net/mailman/listinfo/w124list