[s-cars] Spam / Virus to the list

[Robert Myers]

I'm getting what appear to be the same messages but mine are coming 
(purportedly) from: "Mbme" <mbme at eGroups.com>

Here is a typical header and my antivirus software report:

Return-Path: <mbme at eGroups.com>
Received: from inbound-mx10.atl.registeredsite.com ([64.224.219.102])
           by imta05a2.registeredsite.com with ESMTP
           id 
<20040616230609.FSOE1055.imta05a2.registeredsite.com at inbound-mx10.atl.registeredsite.com>
           for <robert at s-cars.org>; Wed, 16 Jun 2004 19:06:09 -0400
Received: from quattro.net (63-231-52-77.tukw.qwest.net [63.231.52.77])
         by inbound-mx10.atl.registeredsite.com (8.12.11/8.12.8) with SMTP 
id i5GN5OaH007972
         for <robert at s-cars.org>; Wed, 16 Jun 2004 23:05:26 GMT
Date: Wed, 16 Jun 2004 16:06:42 -0800
To: "Robert" <robert at s-cars.org>
From: "Mbme" <mbme at eGroups.com>
Subject: Hidden message
Message-ID: <izmgznqpddpistwwpfc at s-cars.org>
MIME-Version: 1.0
Content-Type: multipart/mixed;
         boundary="--------mroabuipfmoebmawhrhq"



Viruses found in the attached files.
The attached file Smoke.com is infected by I-Worm/Bagle.AB. The attachment 
was removed from the mail.
_____


At 08:03 PM 6/16/2004 -0400, Charlie Smith wrote:


>In the last few days, these messages have arrived to my s-cars list address:
>
>->DM 39  Jun 15 * Redsfjamoroso      (1583) RE: Message Notify
>   DM 58  Jun 14 * Redsfjamoroso      (1502) Forum notify
>   DM 66  Jun 14 * Redsfjamoroso      (523)  Re: Thanks :)
>   DM 85  Jun 14 * Redsfjamoroso      (581)  Forum notify
>   DM 110 Jun 13 * Redsfjamoroso      (503)  Changes..
>   DM 124 Jun 13 * Redsfjamoroso      (582)  Protected message
>   DM 186 Jun 10 * Redsfjamoroso      (551)  Re: Yahoo!
>   DM 220 Jun 09 * Redsfjamoroso      (554)  Forum notify
>   DM 237 Jun 09 * Redsfjamoroso      (515)  Re: Hello
>   DM 249 Jun 08 * Redsfjamoroso      (547)  RE: Protected message
>
>I've received email to the 'charlie' account from this address also.
>
>They all originate from this point:
>
>Received: from quattro.com (63-231-52-77.tukw.qwest.net [63.231.52.77])
>     or
>Received: from quattro.org (63-231-52-77.tukw.qwest.net [63.231.52.77])
>
>
>I wonder if anybody else is getting these virus messages?
>I suspect somebody's machine on the list is infected.
>
>     Charlie Smith
>_______________________________________________
>S-CAR-List mailing list
>S-CAR-List at audifans.com
>http://www.audifans.com/mailman/listinfo/s-car-list

_____

If you're not outraged you're not paying attention.


Bob
*****
  Robert L. Myers 304-574-2372
  Rt. 4, Box 57, Fayetteville, WV 25840 USA WV tag Q SHIP
  '95 urS6 Cashmere Grey - der Wunderwagen ICQ 22170244
  http://www.cob-net.org/church/pvcob.htm
*****