The answer is at the bottom.
Lee Einer wrote:
>
> Hi, all-
>
> I just got an e-mail returned to me by postmaster@cox.net, but I didn't
> send the e-mail in question. The e-mail source is as follows- and there
> was apparently a file attached- what is this? Why am I getting returned
> e-mail which I never sent?
>
> >From - Mon Aug 26 10:24:17 2002
> X-UIDL: <E17jTcw-00037E-00@harrier.mail.pas.earthlink.net>
> X-Mozilla-Status: 0001
> X-Mozilla-Status2: 00000000
> Return-Path: <srrico@earthlink.net>
> Received: from harrier.mail.pas.earthlink.net ([207.217.120.12])
> by fed1mtai02.cox.net
> (InterMail vM.5.01.04.05 201-253-122-122-105-20011231) with ESMTP
> id <20020826235107.SLNO24000.fed1mtai02.cox.net@harrier.mail.pas.earthlink.net>
> for <appealsman@cox.net>; Mon, 26 Aug 2002 19:51:07 -0400
> Received: from user-33qtm4t.dialup.mindspring.com ([199.174.216.157] helo=Pankdc)
> by harrier.mail.pas.earthlink.net with smtp (Exim 3.33 #1)
> id 17jTcw-00037E-00
> for appealsman@cox.net; Mon, 26 Aug 2002 16:50:35 -0700
> From: postmaster <postmaster@cox.net>
> To: appealsman@cox.net
> Subject: Undeliverable mail--"inserting missing "
> MIME-Version: 1.0
> Content-Type: multipart/alternative;
> boundary=MR8491G3GqS58vN8a5S037x2101Kl10
> Message-Id: <E17jTcw-00037E-00@harrier.mail.pas.earthlink.net>
> Date: Mon, 26 Aug 2002 16:50:35 -0700
>
> --MR8491G3GqS58vN8a5S037x2101Kl10
> Content-Type: text/html;
> Content-Transfer-Encoding: quoted-printable
>
> <HTML><HEAD></HEAD><BODY>
>
> <FONT>The following mail can't be sent to 24C01AA0AD6@its-pharm.vcp.monash.edu.au:<br>
> <br>
> From: appealsman@cox.net<br>
> To: 24C01AA0AD6@its-pharm.vcp.monash.edu.au<br>
> Subject: inserting missing <br>
> The file is the original mail</FONT></BODY></HTML>
>
> --MR8491G3GqS58vN8a5S037x2101Kl10
> Content-Type: application/octet-stream;
> name=size.scr
^^^^^^^^^^^^^
My guess is a klez (or similar) worm. It sends out mail to people and
spoofs the mail as being from someone in the victim's outlook address
book. I was the spoofee a few weeks ago and someone notified me that I
was sending out viruses. Heh, not very likely.
George
(text/plain)