More viruses being sent directly to list users

[Brian Carling]

John - REPORT all such messages to your ISP and also send a copy WITH
FULL HEADERS to:

spamcop at spamcop.net

Hopefully they will track this bastard down and put him in the slammer with
the other hacker who just got sent to prison. (The Melissa Virus guy)

I am sure the FBI would be very interested in this matter!

On 19 Dec 99, at 17:22, John Farrington wrote:

> Virus attachments to E-mails continue to be E-mailed directly to users
> of this list (not via the list):                     ^^^^^^^^
>               ^^^^^^^^^^^^^^^^
> On 12/18/99 Dave (AI7R, List Admin) mentioned that:
> > Myself and at least one other person has gotten a message from an
> > unknown source that contained what looked like a copy of the bboy.exe
> > (Bubble Boy) virus.  We didn't open it to find out of course, and
> > that's exactly what you have to do if you get one...not open it.
>
> Today I received a similar worm attachment named "HOG.EXE", so be
> warned that someone with access to this list is sending destructive
> virus/worm files directly to our E-mail addresses copied from the
> list. There is a notice about these worms and others on Symantec's
> site at:
>
>   http://www.symantec.com/avcenter/venc/data/worm.newapt.html
>
> The E-mail message will have a subject line from messages posted on
> the Heath list, and the return address may be forged to make it look
> like it originated from yourself via your local ISP.
>
> The attached worm file may be named something like these:
>
>    g-zilla.exe, cooler3.exe, cooler1.exe, copier.exe, video.exe,
>    pirate.exe, goal1.exe, hog.exe, party.exe, saddam.exe, monica.exe,
>    boss.exe, farter.exe, cheeseburst.exe, panther.exe, theobbq.exe,
>    goal.exe, baby.exe, bboy.exe, cupid2.exe, fborfw.exe, casper.exe,
>    irnglant.exe, or gadget.exe.
>
> In this case the bogus E-mail came from or via 209.123.116.60, which
> belongs to:
>
>     Net Access Corp., 110 S. Jefferson Rd, Newton, NJ, 07860,
>  and/or               104 Broadway, Denville, NJ, 07834,
>      Coordinator Ryan Pavely  (201) 983-0725
>                  paradox at NAC.NET,
>
> so perhaps someone on our list has local access to that phone number
> and could inform Mr. Pavely that one of NAC's addresses is being used
> to forward virus files. Maybe they have the means to trace it.
>
> 73
>
> John Farrington  KE5ZB
>
>
>
>
>
>
>
>
>
>
>
> A worm named HOG.EXE
>
> Sponsored by the City of Tempe
>
> Listserver Submissions:  heath at listserv.tempe.gov
> Listserver Subscription: listserv at listserv.tempe.gov - "subscribe heath 'name' 'call'"
> Listserver Unsubscribe: listserv at listserv.tempe.gov - -"signoff heath"
>

Sponsored by the City of Tempe 

Listserver Submissions:  heath at listserv.tempe.gov
Listserver Subscription: listserv at listserv.tempe.gov - "subscribe heath 'name' 'call'"
Listserver Unsubscribe: listserv at listserv.tempe.gov - -"signoff heath"