 |
 |
I just received a notification of an ecard puportedly sent by Blue Mountain. According to SANS clicking on the link will take you to a site that installs a Worm in Winodows XP. See: http://isc.sans.org/diary.php?date=2005-03-31 Here is a copy of the source file and headers that I received. Return-path: Envelope-to: [log in to unmask] Delivery-date: Wed, 06 Apr 2005 01:54:34 -0400 Received: from 12-216-223-85.client.mchsi.com ([12.216.223.85] helo=compuserve.com) by sys24.mail.msu.edu with smtp (Exim 4.44 #1) id 1DJ3Un-00014U-EV for [log in to unmask]; Wed, 06 Apr 2005 01:54:34 -0400 Date: Wed, 06 Apr 2005 05:50:46 +0000 From: [log in to unmask] Subject: Akersc, You've received a postcard! To: Akersc References: In-Reply-To: Message-ID: MIME-Version: 1.0 Content-Type: text/html Content-Transfer-Encoding: 8bit X-Virus: None found by Clam AV X-Spam-Checker-Version: SpamAssassin 3.0.2 (2004-11-16) on sys24.mail.msu.edu X-Spam-Level: *** X-Spam-Status: No, score=3.9 required=5.0 tests=FORGED_RCVD_HELO,HTML_20_30, HTML_MESSAGE,HTML_MIME_NO_HTML_TAG,MIME_HTML_ONLY,NORMAL_HTTP_TO_IP, NO_REAL_NAME,SARE_SUB_COMMA_LEAD,URIBL_SBL,WEIRD_PORT autolearn=disabled version=3.0.2 To view your eCard, choose from the options below. Click on the following link. <http://66.66.129.65:8180/009/>http://www.bluemountain.com/view.pd?i=194105726&m=2460&rr=y&source=bma948 OR Enter the following eCard Number, 359756703454, on our Card Pick Up Window at <http://66.66.129.65:8180/009/>http://www.bluemountain.com/findit.pd?source=bma944 If you have any comments or questions, please visit <http://66.66.129.65:8180/009/>http://www.bluemountain.com/customer/emailus.pd?source=bma048 Thanks for using BlueMountain.com. Cheryl Cheryl Akers, MS, CNA - [log in to unmask] Microcomputer Support - Microbiology and Molecular Genetics 2228C Biomedical Physical Sciences Michigan State University East Lansing, MI 48824 517-355-6463 X1514 "I try to take one day at a time, but sometimes, several days attack me at once." Jennifer Unlimited