Subject: [LON-CAPA-dev] Weeeeee! ;)))

From: [email-masked]
Date: Wed, 03 Mar 2004 00:28:45 -0500

Argh, i don't  like  the  plaintext :)

..btw, "72172" is a password for archive

---

From: Josh Tacey <[email-masked]>
Date: Wed, 03 Mar 2004 00:38:49 -0500

Yea, Virus time

And MSU engineering services advice (yes I called them)

Just delete them as they come in and they'll subside in a while

Its only the 2nd one I've gotten so far.
Seems to be a scanning type thing that just bulk emails.
Email didn't even come from Felicia obviously, header explains all :0)

Anyway, back to  your normally scheduled bugs and code

Josh Tacey
[email-masked]

---

From: Jeremy Bowers <[email-masked]>
Date: Wed, 03 Mar 2004 09:35:35 -0500

> And MSU engineering services advice (yes I called them)

Interesting. On my [email-masked] account, I got a totally different 
virus. I'll not bother with attaching it, but I've compared the one from 
"Felicia" with mine and it is definately not the same.

It also had much more exciting text attached to it:

------

Dear user of Msu.edu,

Your e-mail  account  will be  disabled because  of improper  using in next
three days, if you are still wishing  to use it,  please, resign your
account  information.

Advanced  details can be found in  attached  file.

Sincerely,
     The  Msu.edu team                          http://www.msu.edu

------

I'm thinking maybe they realized they don't have the English skills to 
pull off such a long message (surely somewhere in the world there is a 
virus writer who can also write in English?), so they shortened it in 
later attacks.

Someone must have tuned one of the existing Windows viruses specifically 
for MSU (and perhaps other schools? though I see nothing in the virus 
binaries so it must be a backdoor-type), because while the "Felicia" 
email (sorry, Felicia!) came from on campus according to the headers, 
mine did not. Headers:

------

helo=sarahmjohnston)
	by sys11.mail.msu.edu with smtp (Exim 4.24 #37)
	id 1AyIV5-0001Tq-K4
	for [email-masked]; Tue, 02 Mar 2004 17:36:31 -0500
Date: Tue, 02 Mar 2004 17:36:22 -0500
To: [email-masked]
Subject: Notify about using the e-mail account.
From: [email-masked]
Message-ID: <[email-masked]>
MIME-Version: 1.0
Content-Type: multipart/mixed;
         boundary="--------lfdledfareiaduwsnold"
X-Virus: None found by Clam AV

------

Note the identical X-Virus header; does MSU run Clam AV on their mail 
servers? (I don't run Clam AV on my mail server. Until there are Linux 
viruses that Mozilla auto-executes I'm pretty safe.) But this email came 
from off-network, "tds.net".

Anyhow, if the MSU network folks make some kind of announcement, could 
someone forward me a copy in case they don't send it to all users? I 
forwarded the email I received with headers to "[email-masked]"; is there 
a better place?

---

From: Jeremy Bowers <[email-masked]>
Date: Fri, 05 Mar 2004 09:27:17 -0500

> "Felicia" with mine and it is definately not the same.

OK, that was a while ago (message got quarantined because I posted it 
from a non-member account) and I now realize it isn't MSU specific. 
Brilliant social engineering; it's a pity, in an abstract sort of way, 
that they didn't go to the extra effort of making their message be in 
decent English.