27-09-2003 23:51									#1
	I have received an e-mail from someone claiming to be MarkG, containing a virus Browse Apolyton AD-FREE

Did anyone else receive this?

The e-mail is from "markg" written like that, e.g. with no capitals. And it has the following subject: "re:asmodean,look,my beautiful girl friend" again with no capitals.

It contained the virus: W32.Klez.H@mm

This is indeed weird. Either it is a worm, automatically sent from Mark's Apolyton adress, or someone knows that I am a 'poly member, and sends an e-mail claiming to be Mark.

Either way, Norton Antivirus blocked it, so nothing happened.

Asmodean

	28-09-2003 00:07									#2
	Avatar Enlargement: We've got the solution

thanks for the heads up. the promise of greek chicks will be a warning.

	28-09-2003 00:17									#3
	Support Apolyton, buy Galactic Civilizations: Deluxe Edition

Either Mark has gotten infected or someone from Apolyton is out to get you Asmodean.

Asmodean, have you made any enemies on Apolyton lately?

Either way, thank God for Norton!

	28-09-2003 00:23									#4
	Support Apolyton, buy Galactic Civilizations: Deluxe Edition

quote: Originally posted by Wittlich Asmodean, have you made any enemies on Apolyton lately?

Maybe MarkG is out to get him...........

	28-09-2003 00:29									#5
	Browse Apolyton AD-FREE

Just check the full header of the message for the SMTP server which sent it (should contain apolyton.net) and also notice that messages sent by Markos are labeled "Markos Giannopoulos" as sender.

	28-09-2003 00:31									#6
	Avatar Enlargement: We've got the solution

Oh yeah...I forgot to add that the sender adress was markg@apolyton.net.

That is Mark's Apolyton adress, isn't it?

Asmodean

	28-09-2003 00:33									#7
	Avatar Enlargement: We've got the solution

quote: Originally posted by Asuka Just check the full header of the message for the SMTP server which sent it (should contain apolyton.net) and also notice that messages sent by Markos are labeled "Markos Giannopoulos" as sender.

Are you sure of that, Asuka. I have never received an e-mail from Mark before. Also, can an SMTP header be spoofed? 'Cause it sure is from Apolyton.net

Asmodean

	28-09-2003 00:38									#8
	Support Apolyton

I was able to extract the following from the e-mail:

code:

X-Symantec-TimeoutProtection: 0
X-Symantec-TimeoutProtection: 1
Return-Path: JTAYLOR256@comcast.net
Received: from rwcrmhc12.comcast.net ([216.148.227.85])
          by fepX.post.tele.dk
          (InterMail vM.5.01.06.05 201-253-122-130-105-20030824) with ESMTP
          id <20030927135738.OPPO12852.fepX.post.tele.dk@rwcrmhc12.comcast.net>
          for ; Sat, 27 Sep 2003 15:57:38 +0200
Date: Sat, 27 Sep 2003 13:57:29 +0000 (GMT)
X-Comment: Sending client does not conform to RFC822 minimum requirements
X-Comment: Date has been added by Maillennium.
Received: from Kvxm (pcp03463143pcs.indpnd01.mo.comcast.net[68.86.43.63])
          by comcast.net (rwcrmhc12) with SMTP
          id <2003092713572701400f9pkae>; Sat, 27 Sep 2003 13:57:27 +0000
From: markg 
To: asmodean@xxxxxxxx.dk
Subject: Re:asmodean,look,my beautiful girl friend
MIME-Version: 1.0
Content-Type: multipart/alternative;
	boundary=U881k0iHXu4qfKf36239847H1
Message-Id: <20030927135738.OPPO12852.fepX.post.tele.dk@rwcrmhc12.comcast.net>

Last edited by Asmodean on 28-09-2003 at 12:51

	28-09-2003 00:55									#9
	Support Apolyton, buy Alpha Centauri

And advance webcrawler bot for spam mail sendings could be possible.

	28-09-2003 01:12									#10
	Support Apolyton, buy Call to Power 2

the "from" field is by no means a very safe way to judge the real sender of a mail

	28-09-2003 01:18									#11
	Support Apolyton buy from Amazon

I am aware of that, Mark. Or I have become aware tonight

Could you check, or have Dan check, if the sender JTAYLOR256@COMCAST.NET is an Apolyton member, and if so give him a slap on the wrist

Asmodean

	28-09-2003 01:24									#12
	Support Apolyton, buy Civilization III: Complete

Seems like a slap on the face would be more in order. Preferably with a heavy blunt object.

	28-09-2003 01:31									#13
	Increase the size of your Attachments

quote: Originally posted by Gramphos And advance webcrawler bot for spam mail sendings could be possible.

I don't think so, Gramphos.

That would require my e-mail addy to be "out there" which it is definately not. I am extremely precautious with whom I give this e-mail addy.

Plus there are too many coincidences. I am an Apolyton member, and the mail came from MarkG. How would a webcrawler bot ever find that information, and link it to my e-mail adress?

Asmodean

	28-09-2003 01:32									#14
	Browse Apolyton AD-FREE

quote: Originally posted by Asmodean Could you check, or have Dan check, if the sender JTAYLOR256@COMCAST.NET is an Apolyton member, and if so give him a slap on the wrist

it's almost certain that it's not....

	28-09-2003 01:37									#15
	Lose 30 kilos (of popups)

I know, Mark. But this has kinda freaked me out a bit. I have reported the incident to the ISP that is behind that e-mail addy. We'll see where that leads. If this person truly wanted to hide, he'd have used a hotmail account.

He didn't. That adress is from a regular ISP account. I hope that proves to be a costly mistake.

Asmodean

	28-09-2003 01:44									#16
	Suffering from ads?

quote: Originally posted by Asmodean That would require my e-mail addy to be "out there" which it is definately not. I am extremely precautious with whom I give this e-mail addy.

i've not put my imarton.net address anywhere public and yet i've recieved spam on it....

btw, viruses are usually transferred without the knowledge of the sender...

	28-09-2003 01:47									#17
	Support Apolyton, buy GURPS/ Alpha Centauri

quote: Originally posted by MarkG btw, viruses are usually transferred without the knowledge of the sender...

I know, Mark.

It's the MarkG thing that makes me wonder if this case is different. But of course, I may be wrong

Asmodean

	28-09-2003 02:20									#18
	Support Apolyton, buy GURPS/ Alpha Centauri

Intiguing to say the least. Asmodean, let us know what you find out from the ISP.

	28-09-2003 02:23									#19
	Support Apolyton buy from Amazon

quote: Originally posted by Asmodean Are you sure of that, Asuka.

Yes, I am. Why? I have received e-mail from the real Mr. Giannopoulos.

quote: Also, can an SMTP header be spoofed?

AFAIK nope.

Markos,

indeed, but sure you know at least to be aware that something isn't like usually if the sender uses a different name. Of course checking the header will do it.

And that person appears to be a Comcast cable modem user somewhere in Missouri, USA (possibly St. Louis).

	28-09-2003 05:16									#20
	Tired of ads?

Seeing there are 40.000 members, this could be all just be pure chance...

But strange it is indeed.

	28-09-2003 05:17									#21
	Support Apolyton, buy Alpha Centauri

quote: Originally posted by Asmodean It's the MarkG thing that makes me wonder if this case is different. But of course, I may be wrong

Bot alert! It could be that the bot located your address on apolyton (either in the data or on the site), and "markg", and lo and behold...

I'm thinking a bot.

	28-09-2003 07:11									#22
	Enter the AD-FREE zone

Bah. I get an occasional e-mail to one of my Yahoo accounts that's allegedly from "Microsoft Security," and insists that I use the attached "patch" immediately because there are "more than 500,000 viruses out there."

First of all, I'm on a Macintosh. Second of all, I really, really doubt Microsoft — which doesn't send security patches via e-mail in the first place — has an origination point that's somewhere in Russia!

What the hell do they take us for? Idiots?

Gatekeeper

	28-09-2003 07:36									#23
	Got spare money?

90% of humans are idiots.

	28-09-2003 07:47									#24
	Support Apolyton, buy Galactic Civilizations: Deluxe Edition

I like to keep samples of the viruses I get.

	28-09-2003 07:59									#25
	Support Apolyton

that is just un-natural Tassadar...also a little bit worrisome!

	28-09-2003 08:19									#26
	Increase Your PM Length

Building an arsenal Tass? Be warned, viruses may be declared weapons of mass destruction....

	28-09-2003 08:52									#27
	Support Apolyton, buy Civilization 2

This is the information I found on the W32.Klez.H@mm. Apparently McAFee classifies it as a worm, and the .H variant seems to be the most successful one.

	28-09-2003 09:29									#28
	Support Apolyton or Terrorists Win

When I am in my Apolyton e-mail I recieve countless e-mails from admin@apolyton.net that contain viruses.

	28-09-2003 10:45									#29
	Got spare money?

quote: Originally posted by Asmodean That would require my e-mail addy to be "out there" which it is definately not. I am extremely precautious with whom I give this e-mail addy.

It's 'out there' now, since it is contained in the header you posted; unless you modified that bit, of course...

	28-09-2003 12:52									#30
	Get a bigger avatar today!

Bah...I missed that one. Thanks nye. Modified now

Asmodean