June 2003 - NANOG - lists.nanog.org

RE: Weird email messages with "re:movie" and "re:application" in the subject line..
by McBurnett, Jim 26 Jun '03

26 Jun '03

got it here too.. And on 30+ publicly annouced mail accounts.... Hitting big.. sobig virus once again... Jim -----Original Message----- From: Anne P. Mitchell, Esq. [mailto:amitchell@habeas.com] Sent: Wednesday, June 25, 2003 11:05 PM To: 'nanog(a)merit.edu' Subject: Re: Weird email messages with "re:movie" and "re:application" in the subject line.. > New spam technique or some new virus, similar to a Melissa? Any body > else seeing this? We're seeing it here too, coming to role accounts. Our folks are saying virus, but haven't identified which one yet. Anne

3 2

Major E-mail Delivery for FTC DNCR Launch
by Callahan, Richard M, SOLGV 26 Jun '03

26 Jun '03

Good Afternoon and forgive the new guy if I break any rules or conventions. I work for AT&T Government Solutions and we are about to launch the Do Not Call Registry for the Federal Trade Commission. At a high level this allows consumers to register their phone numbers to keep most telemarketers from calling their homes. Penalties for calling a consumer on the list can be $11K per call and enforcement begins in October. We are launching consumer registrations on Friday. My concern: - every registration using the web generates an email which must be opened to complete the registration process We are looking at the potential of MILLIONS OF EMAILS PER DAY beginning Friday. These will be from the same address and have the same subject line. I am worried about denial of service or blocking by spam filters if providers are not aware this is coming. I am hoping this group is a good medium to get the word out to inform the community of this impending event. At this time I am unable to provide the link or email address, but will do so on Thursday evening if it is of value. Any thoughts? Richard M. Callahan Client Business Manager AT&T Government Solutions Office: (703)506-5780 Mobile: (703)608-0665 Fax: (703)245-3749

10 9

Re: companies like microsoft and telia...
by Paul Vixie 26 Jun '03

26 Jun '03

> > grrrrrrrrrrrrr. > > telia has been on my list for 2.5 years now for this stuff. let the public shaming begin, then. four isp abusebots have rejected my complaints tonight because (gasp!) i included a copy of the virus i was complaining about. cluestick please!

2 1

RE: Weird email messages with "re:movie" and "re:application" in the subject line..
by Mark Segal 26 Jun '03

26 Jun '03

Here the best link I have seen so far... Thanks to kevin day.. http://securityresponse.symantec.com/avcenter/venc/data/w32.sobig.e@mm.html My guess is they might need to upgrade it to more than 55-999 infections :). mark -- Mark Segal Director, Network Planning FCI Broadband Tel: 905-284-4070 Fax: 416-987-4701 http://www.fcibroadband.com Futureway Communications Inc. is now FCI Broadband -----Original Message----- From: Eric Brunner-Williams in Portland Maine [mailto:brunner@nic-naa.net] Sent: June 25, 2003 11:25 PM To: Larry Rosenman Cc: Mark Segal; 'nanog(a)merit.edu'; brunner(a)nic-naa.net Subject: Re: Weird email messages with "re:movie" and "re:application" in the subject line.. > W32/sobig.e@MM per McAffee..... I seem to have done one better ... according to a M$ host in Level3-land, the Unix box right in front of me sent the mail in question. Someone at L3 needs to call home. The only L3 turd in my mail log is their inbound... Jun 25 18:21:11 nic-naa sm-mta[24589]: h5PMLB5U024589: from=<administrator(a)Level3.com>, size=1711, class=0, nrcpts=1, msgid=<012d01c33b68$2bd14b40$d706010a(a)corp.global.level3.com>, proto=ESMTP, daemon=MTA, relay=machine77.Level3.com [209.244.4.106] Cheers, Eric ------- Forwarded Message Return-Path: administrator(a)Level3.com Delivery-Date: Wed Jun 25 18:21:11 2003 Return-Path: <administrator(a)Level3.com> Received: from f1ee40-19.idc1.level3.com (machine77.Level3.com [209.244.4.106]) by nic-naa.net (8.12.9/8.12.9) with ESMTP id h5PMLB5U024589 for <brunner(a)nic-naa.net>; Wed, 25 Jun 2003 18:21:11 -0400 (EDT) Received: from idc1exc0001.corp.global.level3.com (localhost [127.0.0.1]) by f1ee40-19.idc1.level3.com (8.8.8p2+Sun/8.8.8) with SMTP id WAA02577 for <brunner(a)nic-naa.net>; Wed, 25 Jun 2003 22:21:50 GMT Received: from idc1exc0005.corp.global.level3.com ([10.1.6.215]) by idc1exc0001.corp.global.level3.com with Microsoft SMTPSVC(5.0.2195.4905); Wed, 25 Jun 2003 16:21:49 -0600 Received: from mail pickup service by idc1exc0005.corp.global.level3.com with Microsoft SMTPSVC; Wed, 25 Jun 2003 16:21:49 -0600 thread-index: AcM7aCvRcfOY+VcOT2aAnuNoWHZmCQ== Thread-Topic: [MailServer Notification]Alert to Sender: File Attachment Blocked From: <Administrator(a)machine77.level3.com> Sender: <Administrator(a)machine77.level3.com> To: <brunner(a)nic-naa.net> Subject: [MailServer Notification]Alert to Sender: File Attachment Blocked Date: Wed, 25 Jun 2003 16:21:49 -0600 Message-ID: <012d01c33b68$2bd14b40$d706010a(a)corp.global.level3.com> MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit X-Mailer: Microsoft CDO for Exchange 2000 Content-Class: urn:content-classes:message Importance: normal Priority: normal X-MimeOLE: Produced By Microsoft MimeOLE V5.50.4920.2300 X-OriginalArrivalTime: 25 Jun 2003 22:21:49.0631 (UTC) FILETIME=[2BF044F0:01C33B68] ScanMail for Microsoft Exchange has blocked an attachment. Sender = brunner(a)nic-naa.net Recipient(s) = ops(a)genuity.com Subject = Re: Movie Scanning time = 06/25/2003 16:21:49 Action on file blocking: The attachment your_details.zi matches the file blocking settings. ScanMail has Deleted it. Attachment blocked due to extension match of .bat, .eml, .nws, .pif, .scr, .src, .shs, .vbe, .vbs, .com, or .exe. ------- End of Forwarded Message

1 0

Weird email messages with "re:movie" and "re:application" in the subject line..
by Mark Segal 26 Jun '03

26 Jun '03

My email box has started receiving a bunch of emails recently (earlier this evening) with a 80k zip attachment called "your_details.zip" and either "re:movie" and "re:application" from a whole bunch of other address I have never heard of.. New spam technique or some new virus, similar to a Melissa? Any body else seeing this? mark -- Mark Segal Director, Network Planning FCI Broadband Tel: 905-284-4070 Fax: 416-987-4701 http://www.fcibroadband.com Futureway Communications Inc. is now FCI Broadband

5 4

autoresponders, spam verifiers.
by Mark Segal 26 Jun '03

26 Jun '03

Isn't it against nanog's BCP to have auto responders reply to people who post to the list... This is very annoying ever time I post.. and being the zealot that I am (I know 50,000 heads just nodded their agreement) I do not want to be on his "safe" list. mark -- Mark Segal Director, Network Planning FCI Broadband Tel: 905-284-4070 Fax: 416-987-4701 http://www.fcibroadband.com <http://www.fcibroadband.com/> Futureway Communications Inc. is now FCI Broadband -----Original Message----- From: AntiSpam UOL [mailto:armenio.lobato.sspam@uol.com.br] Sent: June 25, 2003 11:11 PM To: msegal(a)corporate.fcibroadband.com Subject: RE:RE: Weird email messages with "re:movie" and "re:application" in <http://antispam.uol.com.br> <http://mail.i.uol.com.br/tirateima_txt.gif> <http://www.uol.com.br> Olá, Você enviou uma mensagem para armenio.lobato(a)uol.com.br Para que sua mensagem seja encaminhada, por favor, clique aqui Esta confirmação é necessária porque armenio.lobato(a)uol.com.br usa o Antispam UOL, um programa que elimina mensagens enviadas por robôs, como pornografia, propaganda e correntes. _____ Hi, You´ve just sent a message to armenio.lobato(a)uol.com.br In order to confirm the sent message, please click here This confirmation is necessary because armenio.lobato(a)uol.com.br uses Antispam UOL, a service that avoids unwanted messages like advertising, pornography, viruses, and spams. Use o <http://antispam.uol.com.br> AntiSpam UOL e proteja sua caixa postal

1 0

RE: Weird email messages with "re:movie" and "re:application" in the subject line..
by Williamson, Todd 26 Jun '03

26 Jun '03

At least the "Re: Application" message is referenced here: http://vil.nai.com/vil/content/v_100429.htm I received several of these today. Don't know about "Re: movie". todd > My email box has started receiving a bunch of emails recently > (earlier this > evening) with a 80k zip attachment called "your_details.zip" > and either > "re:movie" and "re:application" from a whole bunch of other > address I have > never heard of.. > > New spam technique or some new virus, similar to a Melissa? > Any body else > seeing this? > > mark > > > -- > Mark Segal > Director, Network Planning > FCI Broadband > Tel: 905-284-4070 > Fax: 416-987-4701 > http://www.fcibroadband.com > > Futureway Communications Inc. is now FCI Broadband >

1 0

RE: Weird email messages with "re:movie" and "re:application" in the subject line..
by Mark Segal 26 Jun '03

26 Jun '03

That body should read ... "either "re:movie" and "re:application" in the subject line" Sorry, mark -- Mark Segal Director, Network Planning FCI Broadband Tel: 905-284-4070 Fax: 416-987-4701 http://www.fcibroadband.com Futureway Communications Inc. is now FCI Broadband -----Original Message----- From: Mark Segal [mailto:MSegal@Corporate.FCIBroadband.com] Sent: June 25, 2003 10:57 PM To: 'nanog(a)merit.edu' Subject: Weird email messages with "re:movie" and "re:application" in the subject line.. My email box has started receiving a bunch of emails recently (earlier this evening) with a 80k zip attachment called "your_details.zip" and either "re:movie" and "re:application" from a whole bunch of other address I have never heard of.. New spam technique or some new virus, similar to a Melissa? Any body else seeing this? mark -- Mark Segal Director, Network Planning FCI Broadband Tel: 905-284-4070 Fax: 416-987-4701 http://www.fcibroadband.com Futureway Communications Inc. is now FCI Broadband

1 0

Re: Major E-mail Delivery for FTC DNCR Launch
by Anne P. Mitchell, Esq. 26 Jun '03

26 Jun '03

Oops..2nd time, sorry - had to resub to NANOG and hadn't actually sent the sub to -post. > Except possibly don't use the word "spam", or anything else that is > liable to trip SpamAssassin and friends into giving your messages a > high score (so references to abdominal anatomy and cable tv decoders > are also probably unwise :). > > I'm frequently surprised that more people don't run their (legitimate, > opt-in, whatever) bulk mail through SpamAssassin before they send it > in order to see how spam-like it looks. I'm forever having to pick > itineraries and electronic tickets from airlines out of my spam > folder. Send them to us; we're happy to tell them to use Habeas. :-) (SpamAssassin is a partner, and whitelists mail using our headers, so those itineraries and e-tickets will sail through SpamAssassin, along with about 3 dozen other ISP and spam filter partners :-) Of course, if it's mailing list mail, it *has* to be confirmed opt-in.] Anne

1 0

Country of Origin for Malicious Attacks
by sgorman1＠gmu.edu 26 Jun '03

26 Jun '03

I was wondering if folks had noticed any trends with malicious network attacks predominantly originating from any individual or group of countries. Any observations, comments or help would be greatly appreciated. Thanks, sean

2 1