1  |   Order by index

Apr 5, 2004, 8:17am

[View Quote] > Hi,
>
>
> someone seems to send out suspicious files at the moment.
>
> I just received a zipped RWX model - nothing bad about it.
>
> But then I received some password protected zipped EXE
> files and a GIF (with JPeg extension) with the password
> information.
>
> Be careful with this stuff, even if the sender seems to
> be familiar!
>
>
> Volker
>
We have now a new infected computer in Bullhead, Arizona (the computer name is probably toddspent4):
From - Mon Apr 05 06:39:31 2004
X-UIDL: MD50000023686:MSG:34099:1373612421
X-Mozilla-Status: 0001
X-Mozilla-Status2: 10000000
Return-path: <alphabit at swbell.net>
Received: from toddspent4.com ([24.121.43.224])
by andras.net (andras.net [194.152.129.221])
(MDaemon.PRO.v6.8.5.R)
with ESMTP id 51-md50000000012.tmp
for <andrass9 at andras.net>; Mon, 05 Apr 2004 06:45:10 +0200
Date: Sun, 04 Apr 2004 21:37:42 -0700
To: andras at andras.net
Subject: Incoming message
From: alphabit at swbell.net

Since the address is fairly static (Cable) please do a search in your world log files, maybe it turns up who is it.


--
Andras
"It's MY computer" (tm Steve Gibson)

1  |   Order by index