On Tue, 19 Aug 2003 09:23:54 -0400
Tom Melton <Tom_Melton AT EMORYHEALTHCARE DOT ORG> wrote:

> I hate to spam the list, but someone on this list has a virus that is
> sending boatloads of emails under various names from this list.  I was
> trying to determine which list it was from, then saw one from Wanda
> Prather, and knew then it was this one.
>
> Please check your outboxes/sent items folder and see if you have many
> emails that you did not actually send, and then get the virus cleaned off
> your machine.
>
> I cannot recall the name of this variant, but it sends emails to those in
> your Outlook/Outlook Express Address Book, and masks the original sender
> with another name from the Address Book.
>
> Subject lines like:
>
> Re: My details
> Re: Wicked screensaver
> Re: Your application
> Re: Details
> Re: That movie
> Re: Approved
>
> And the body has the following:
>
> Re: Approved

I've been able to narrow it down to one ip in norway... in an ip-block ownen
apperently by elektron.no, I've tried notifying abuse@ but that bounced....

btw, the virus is a Sobig.F, see
http://www.sarc.com/avcenter/venc/data/w32.sobig.f AT mm DOT html

--
Met vriendelijke groeten,

Remco Post

SARA - Reken- en Netwerkdiensten                      http://www.sara.nl
High Performance Computing  Tel. +31 20 592 8008    Fax. +31 20 668 3167

"I really didn't foresee the Internet. But then, neither did the computer
industry. Not that that tells us very much of course - the computer industry
didn't even foresee that the century was going to end." -- Douglas Adams