That looks like a variation of MyDoom.c or Beagle-b. yeah, looks like somones windows box got infected (thank god I use linux for all my e-mail needs).. I deal with a lot of this (searching the headers, writing to the various ISP's involved, etc.). you'd be amazed at the results I get from a little personal attention. :) Technomage Hawke On Friday 05 March 2004 01:21 pm, Craig White wrote: > I've been getting these worm/viruses from someone on this list - this is > the second day now - actually someone at sequoia.net (Brian ?)- see > headers... > > Return-Path: > 00006> Received: from localhost (localhost.localdomain [127.0.0.1]) by > linuxserver.azapple.com (8.12.8/8.12.8) with ESMTP id i25KF5Fl024836 for > ; Fri, 5 Mar 2004 13:15:07 -0700 > Received: from mail10.syspac.com [65.165.12.105] by localhost with IMAP > (fetchmail-5.9.0) for craig@localhost (single-drop); Fri, 05 Mar 2004 > 13:15:07 -0700 (MST) > Received: from nillaust (unverified [207.246.52.8]) by > mail-phx-03.alevelhigher.net (Rockliffe SMTPRA 5.3.6) with SMTP id > for > <3C464115.22CDFC77@azapple.com>; Fri, 5 Mar 2004 13:13:13 -0700 > Date: Fri, 05 Mar 2004 13:14:57 -0700 > To: 3C464115.22CDFC77@azapple.com > Subject: Hi! :-) > From: > lists.plug.mybutt.netplug-discuss@lists.plug.mybutt.netmail.sequoia.net0000 >0006 Message-ID: > > MIME-Version: 1.0 > Content-Type: multipart/mixed; boundary="--------vusxdgxdajpmuoidenuo" > X-yoursite-MailScanner-Information: Please contact the ISP for more > information > X-yoursite-MailScanner: Found to be clean > X-yoursite-MailScanner-SpamScore: s > X-Evolution-Source: imap://craig@linuxserver.azapple.com/ --------------------------------------------------- PLUG-discuss mailing list - PLUG-discuss@lists.plug.phoenix.az.us To subscribe, unsubscribe, or to change you mail settings: http://lists.PLUG.phoenix.az.us/mailman/listinfo/plug-discuss