On Thu, 26 Jun 2003, McBurnett, Jim wrote:

Date: Thu, 26 Jun 2003 09:33:16 -0400 From: "McBurnett, Jim" <jmcburnett@msmgmt.com> To: nanog@merit.edu Subject: RE: Weird email messages with "re:movie" and "re:application" in the subject line..

got it here too.. And on 30+ publicly annouced mail accounts.... Hitting big.. sobig virus once again...

Jim

Jim, All Just in the last hour itself, I must have had at least 5 E.mails come to me with a certain 'zipped' file attached, from persons unknown -- who have received E.mails from me with the subject title in question. In each case, the following message, and others of a similar nature were enclosed.

The file attachment your_details.zip (details.pif) you sent to the recipients listed above was infected with the W32/Sobig.e@MM virus and was deleted.

It appears that whomever they are, the perpetrators are using a common spamming technique to harvest addresses from the net for example, and to then use that information to spoof the receivers. I say this because in at least 3 of the 5 cases to which I refer, the ORIGINATING address is an older convention (while it still works) that we no longer use at the University of Hawai'i. Consequently, this leads me to suspect harvesting of dated addresses from the net. Just another experience... Regards, Robert.