[ale] What's with this "RotatE()" message?

Fri Aug 16 23:49:59 EDT 2002

Klez.  It spoofs both the sender and to addresses from Outlook address 
books.  As I understand it, it should have two attachments.  One is the 
virus infected file and the other is a random file picked up off the 
infected computer.  Scarry huh?  Never know where that Quicken checkbook 
file might end up these days...

Jeff Hubbs wrote:
> I just got a big e-mail with attachment - subject of "RotatE()".  I've
> never heard of the sending address.  Header is as follows.  What is
> this??
> 
> The only thing that really tells me anything is where it says
> "Content-Type: audio/x-midi".  
> 
> Evolution just shows the message as blank.  
> 
> - Jeff
> 
> Return-Path: <scorh at verizon.net>
> Received: from out001.verizon.net ([206.46.170.140]) by
> rwcrgwc54.attbi.com
>         (InterMail vM.4.01.03.37 201-229-121-137-20020806) with ESMTP id
>         <20020817023027.UDXV1225.rwcrgwc54.attbi.com at out001.verizon.net>
> for
>         <hbbs at attbi.com>; Sat, 17 Aug 2002 02:30:27 +0000
> Received: from Wciknb ([64.166.210.229]) by out001.verizon.net
> (InterMail
>         vM.5.01.05.09 201-253-122-126-109-20020611) with SMTP id
>         <20020817023017.ZWZQ5628.out001.verizon.net at Wciknb> for
> <hbbs at attbi.com>;
>         Fri, 16 Aug 2002 21:30:17 -0500
> From: scorh <scorh at att.net>
> To: hbbs at attbi.com
> Subject: RotatE() 
> MIME-Version: 1.0
> Content-Type: multipart/alternative; boundary=L039l64HAOl
> Message-Id: <20020817023017.ZWZQ5628.out001.verizon.net at Wciknb>
> Date: Fri, 16 Aug 2002 21:30:27 -0500
> X-Evolution-Source: pop://hbbs@mail.attbi.com/
> 
> 
> --L039l64HAOl
> Content-Type: text/html;
> Content-Transfer-Encoding: quoted-printable
> 
> <HTML><HEAD></HEAD><BODY>
> <iframe src=3Dcid:RF25b3kLe height=3D0 width=3D0>
> </iframe>
> <FONT></FONT></BODY></HTML>
> 
> --L039l64HAOl
> Content-Type: audio/x-midi; name=180000).bat
> Content-Transfer-Encoding: base64
> Content-ID: <RF25b3kLe>
> 
> TVqQAAMAAAAEAAAA//8AALgAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
> AAAA2AAAAA4fug4AtAnNIbgBTM0hVGhpcyBwcm9ncmFtIGNhbm5vdCBiZSBydW4gaW4gRE9TIG1v
> 
> <snip...More junk follows>
> 
> 
> 
> ---
> This message has been sent through the ALE general discussion list.
> See http://www.ale.org/mailing-lists.shtml for more info. Problems should be 
> sent to listmaster at ale dot org.
> 
> 

-- 
Until later: Geoffrey		esoteric at 3times25.net

I didn't have to buy my radio from a specific company to listen
to FM, why doesn't that apply to the Internet (anymore...)?

---
This message has been sent through the ALE general discussion list.
See http://www.ale.org/mailing-lists.shtml for more info. Problems should be 
sent to listmaster at ale dot org.