SPAM emails from "listers"

[Kneale Brownson]

--
I've gotten many such emails in recent months.  A relatively "new"
phenomenon in the etherworld in which a spammer adopts someone else's valid
mailer address and puts it in as the "from".  Most contain some sort of
virus and have been identified thusly by the free Grisoft.com antivirus
program I've been using ever since Sir Myers called it to our attention
several years ago (thank you, Bob).


At 08:02 PM 09/16/2002 -0700, Shayne wrote:

>Okay, recently I have been getting a HUGE bunch of spam emails from
>"listers".  Well, someone posing to be "listers".  EG:  Today, I got three
>including one from Fundsaloracing.  I know fundsalo did not send it as I
>checked the from path and return path and compared it to his return and from
>path.  Same with the spams from the other two "listers".  The content of the
>email was blank, but their was an attachment which I won't open as I don't
>have interest in getting a virus on my computer.  Are any of you other
>listers getting Spamed from these people pretending to be listers???
>
>I would like to find out more and see if we can put a stop to it.
>
>Here is a the title of the attached file names:
>
>Counter.exe and suffolk.lib.ny[1].html
>
>
>below is a copy of the header.  Maybe someone can interpret more then I am
>able to.
>
>
>Return-Path: <webmaster at sublimedirectory.com>
>Received: from smtp-01-002.root-mail.com (mail-01-002.root-mail.com
>[64.7.206.72])
>     by mail1.dogear.net (8.11.6/8.11.6) with ESMTP id g8H0KIG03856
>     for <bcpi at arias.net>; Mon, 16 Sep 2002 17:20:18 -0700
>Received: from Qkugnbxan (ool-182f141f.dyn.optonline.net [24.47.20.31])
>     by smtp-01-002.root-mail.com (8.12.3/8.12.3) with SMTP id g8H0KFxf022561
>     for <bcpi at arias.net>; Mon, 16 Sep 2002 17:20:15 -0700
>Date: Mon, 16 Sep 2002 17:20:15 -0700
>Message-Id: <200209170020.g8H0KFxf022561 at smtp-01-002.root-mail.com>
>From: fundsaloracing <fundsaloracing at yahoo.com>
>To: bcpi at arias.net
>Subject: Some questions
>MIME-Version: 1.0
>Content-Type: multipart/alternative;
>     boundary=YTjZ2Zqc2n440EK4WcZ0H6096xK88GYoRI875
>X-Spam-Status: No, hits=1.4 required=10.0
>     tests=FROM_NAME_NO_SPACES,RELAYING_FRAME,FORGED_YAHOO_RCVD
>     version=2.31
>X-Spam-Level: *
>Status:
>
>
>Thanx,
>Shayne P.
>
>
>Oakland, CA.
>
>Enough Audis to give plenty of headaches.
>
>Parting:  1972 Mercedes Benz 280 SE 4.5
>
>_______________________________________________
>200q20v mailing list
>200q20v at audifans.com
>http://www.audifans.com/mailman/listinfo/200q20v
--