PING : JNUGENT - you're sending out virus's mate

JNUGENT

I just received an e-mail from your account headed

Re: Question for seller -- Item #934222988

and containing a virus infected attachment.

McAfee dealt with it no probs but please sort it out - in case anyone isn't as well protected as me.

-----------== Posted via Newsfeed.Com - Uncensored Usenet News ==----------
http://www.newsfeed.com The #1 Newsgroup Service in the World!
-----= Over 100,000 Newsgroups - Unlimited Fast Downloads - 19 Servers =-----

Doug wrote:

> JNUGENT
>
> I just received an e-mail from your account headed
>
> Re: Question for seller -- Item #934222988
>
> and containing a virus infected attachment.
>
> McAfee dealt with it no probs but please sort it out - in case anyone isn't as well
> protected as me.
>
> -----------== Posted via Newsfeed.Com - Uncensored Usenet News ==----------
> http://www.newsfeed.com The #1 Newsgroup Service in the World!
> -----= Over 100,000 Newsgroups - Unlimited Fast Downloads - 19 Servers =-----

moi aussi

"Peter B" <peter28@btinternet.com> wrote in message news:b33kn2$qfs$1@knossos.btinternet.com...
>
> "NM" <nik.morgan@chello.nl> wrote in message news:3E55460C.4D880FDE@chello.nl...
> > Doug wrote:
> >
> > > JNUGENT
> > >
> > > I just received an e-mail from your account headed
> > >
> > > Re: Question for seller -- Item #934222988
> > >
> > > and containing a virus infected attachment.
> > >
> > > McAfee dealt with it no probs but please sort it out - in case anyone
> isn't
> > > as well protected as me.
>
> > moi aussi
>
> Et moi. BT Openworld intercepted it in my case.

And me . please check it out.
>
> Pete

"NM" <nik.morgan@chello.nl> wrote in message news:3E55460C.4D880FDE@chello.nl...
> Doug wrote:
>
> > JNUGENT
> >
> > I just received an e-mail from your account headed
> >
> > Re: Question for seller -- Item #934222988
> >
> > and containing a virus infected attachment.
> >
> > McAfee dealt with it no probs but please sort it out - in case anyone
isn't
> > as well protected as me.

> moi aussi

Et moi. BT Openworld intercepted it in my case.

Pete

"Paul Kelly" <paul@paulk.fsbusiness.co.uk> wrote in message news:b33l46$hoq$1@news8.svr.pol.co.uk...
>
> "Peter B" <peter28@btinternet.com> wrote in message news:b33kn2$qfs$1@knossos.btinternet.com...
> >
> > "NM" <nik.morgan@chello.nl> wrote in message news:3E55460C.4D880FDE@chello.nl...
> > > Doug wrote:
> > >
> > > > JNUGENT
> > > >
> > > > I just received an e-mail from your account headed
> > > >
> > > > Re: Question for seller -- Item #934222988
> > > >
> > > > and containing a virus infected attachment.
> > > >
> > > > McAfee dealt with it no probs but please sort it out - in case
anyone
> > isn't
> > > > as well protected as me.
> >
> > > moi aussi
> >
> > Et moi. BT Openworld intercepted it in my case.
>
> And me . please check it out.
> >
> > Pete
> >
> >
>

Me too - intercepted by my Uni server's scanner.

On Thu, 20 Feb 2003 22:41:34 +0000, Nathaniel Porter wrote:

> Me too - intercepted by my Uni server's scanner.

I'm using Linux. Please feel free to e-mail it here.

--
________________________
Conor Turton conor_turton@hotmail.com
________________________

"PeterE" <peter@NOSPAMringtail.fsnet.co.uk> wrote in message
news:b33lmp$fur$1@newsg3.svr.pol.co.uk...
> Paul Kelly wrote in message ...
> >
> >"Peter B" <peter28@btinternet.com> wrote in message news:b33kn2$qfs$1@knossos.btinternet.com...
> >>
> >> "NM" <nik.morgan@chello.nl> wrote in message news:3E55460C.4D880FDE@chello.nl...
> >> > Doug wrote:
> >> >
> >> > > JNUGENT
> >> > >
> >> > > I just received an e-mail from your account headed
> >> > >
> >> > > Re: Question for seller -- Item #934222988
> >> > >
> >> > > and containing a virus infected attachment.
> >> > >
> >> > > McAfee dealt with it no probs but please sort it out - in case
anyone
> >> isn't
> >> > > as well protected as me.
> >>
> >> > moi aussi
> >>
> >> Et moi. BT Openworld intercepted it in my case.
> >
> >And me . please check it out.
>
> Is it not the case that these viruses can take a random name in someone's address book and use
> that as the "from" address, so it doesn't necessarily come from JNugent's PC, although it gives
> the impression of doing so?
>
> --
> http://www.speedlimit.org.uk "I hate cars. If I ever get any power again, I'd ban the lot." (Ken
> Livingstone, June 1989)
>
>
>
>
>

I think the fact that Jnugent is a regular on these groups and many people coming through as
recipients are also regulars points suggests otherwise. No one is suggesting it is
deliberate though.

-----------== Posted via Newsfeed.Com - Uncensored Usenet News ==----------
http://www.newsfeed.com The #1 Newsgroup Service in the World!
-----= Over 100,000 Newsgroups - Unlimited Fast Downloads - 19 Servers =-----

Paul Kelly wrote in message ...
>
>"Peter B" <peter28@btinternet.com> wrote in message news:b33kn2$qfs$1@knossos.btinternet.com...
>>
>> "NM" <nik.morgan@chello.nl> wrote in message news:3E55460C.4D880FDE@chello.nl...
>> > Doug wrote:
>> >
>> > > JNUGENT
>> > >
>> > > I just received an e-mail from your account headed
>> > >
>> > > Re: Question for seller -- Item #934222988
>> > >
>> > > and containing a virus infected attachment.
>> > >
>> > > McAfee dealt with it no probs but please sort it out - in case anyone
>> isn't
>> > > as well protected as me.
>>
>> > moi aussi
>>
>> Et moi. BT Openworld intercepted it in my case.
>
>And me . please check it out.

Is it not the case that these viruses can take a random name in someone's address book and use that
as the "from" address, so it doesn't necessarily come from JNugent's PC, although it gives the
impression of doing so?

--
http://www.speedlimit.org.uk "I hate cars. If I ever get any power again, I'd ban the lot." (Ken
Livingstone, June 1989)

In article <3e5541f3_6@corp-goliath.newsgroups.com>, dpstirling@hotmail.com spouted forth into
uk.rec.driving...
> JNUGENT
>
> I just received an e-mail from your account headed
>
> Re: Question for seller -- Item #934222988
>
> and containing a virus infected attachment.
>
> McAfee dealt with it no probs but please sort it out - in case anyone isn't as well
> protected as me.

F-Prot running on my mail server let the mail through, but stripped the attachment.

Was just about to mail him, and ask why I was getting mailed

Poor bugger, hope he knows.

--
Carl Robson (The poster formerly known as Skodapilot) http://www.bouncing-czechs.com

"Conor Turton" <conor_turton@hotmail.com> wrote in message
newsan.2003.02.20.22.44.39.143982@hotmail.com...
> On Thu, 20 Feb 2003 22:41:34 +0000, Nathaniel Porter wrote:
>
> > Me too - intercepted by my Uni server's scanner.
>
> I'm using Linux. Please feel free to e-mail it here.
>

I'm using both Windows and Linux, so I get security with the option of being masochistic ;-)

"PeterE" <peter@NOSPAMringtail.fsnet.co.uk> wrote in message
>
> Is it not the case that these viruses can take a random name in someone's address book and use
> that as the "from" address, so it doesn't necessarily come from JNugent's PC, although it gives
> the impression of doing so?

Well yes and no if you look at the headers of the e-mail you will normally be able to trace the
senders address from them. Here is one I keep getting with klez (real e-mail addresses masked with 5
stars for there address and & for
me)

X-From_: *****Sat Feb 15 21:27:04 2003 Return-path: <*****> Envelope-to: &&&&& Delivery-date: Sat,
15 Feb 2003 21:27:04 +0000 Received: from modem-1064.rickt.dialup.pol.co.uk ([62.25.196.40]
helo=Chhqyx) by cmailm5.svr.pol.co.uk with smtp (Exim 4.10.11) id 18k9oy-0002pl-00 for &&&&&; Sat,
15 Feb 2003 21:26:04 +0000 From: complaints <complaints@nomorehits.com> To: &&&&& Subject: Some
questions MIME-Version: 1.0 Content-Type: multipart/alternative; boundary=L4251B74pGE4d4FRXKO2
Message-Id: <E18k9oy-0002pl-00.2003-02-15-21-26-04@cmailm5.svr.pol.co.uk> Date: Sat, 15 Feb 2003
21:26:04 +0000

In this case the only faked e-mail address in in the from field the x-from and return path were both
correct (and normally are) you can also use the Received: from line to trace where it entered the
internet in this care modem-1064.rickt.dialup.pol.co.uk then contact the server admin with a copy of
the header and ask them to double check on there logs and contact the sender. This is one of the
reasons I don't put my address into outlook for news to prevent worms like this from using it as the
from address.

Paul Kelly <paul@paulk.fsbusiness.co.uk> wrote:

> And me . please check it out.

What, exactly, is the point of all these follow-ups, quoting the original piece and effectively just
adding the old AOL staple of "me too"?

Hoagy (got it, but I don't care as I don't run Windows)

"Doug" <dpstirling@hotmail.com> wrote:

goliath.newsgroups.com
|| JNUGENT

|| I just received an e-mail from your account headed Re: Question for seller -- Item #934222988 and
|| containing a virus infected attachment. McAfee dealt with it no probs but please sort it out - in
|| case anyone isn't as well protected as me.

Thanks for the tip off.

Should have been sorted out now (courtesy of the McAfee site).

Sorry, everyone, don't know where it came from.

---
Outgoing mail is certified Virus Free. Checked by AVG anti-virus system (http://www.grisoft.com).
Version: 6.0.456 / Virus Database: 256 - Release Date: 18/02/03

On Fri, 21 Feb 2003 01:13:18 +0000, JNugent wrote:

> Thanks for the tip off.
>
> Should have been sorted out now (courtesy of the McAfee site).
>
> Sorry, everyone, don't know where it came from.

Outlook Express..nuff said.

--
________________________
Conor Turton conor_turton@hotmail.com
________________________

"PeterE" <peter@NOSPAMringtail.fsnet.co.uk> wrote in message
news:<b33lmp$fur$1@newsg3.svr.pol.co.uk>...

> Is it not the case that these viruses can take a random name in someone's address book and use
> that as the "from" address, so it doesn't necessarily come from JNugent's PC, although it gives
> the impression of doing so?

Yes, it's possible, and that's what I assumed when I got the email from him. But with the
significant number of people fingering one sender, it seems unlikely in this case.

James