Re: Interesting email thread with passworded zip file

From: kulm_nd (kn_at_NOISP.net)
Date: 03/03/04

  • Next message: David Mertz, Ph.D.: "Explanation of usage spike (malicious DOS attack?)" 
    Date: Wed, 03 Mar 2004 05:17:51 GMT

    My ISP has already posted warnings, a virus/trojan for sure. 

    -- 
************************************************
g-w
"Leythos" <void@nowhere.com> wrote in message
news:MPG.1aaf30d91b15021998a2b5@news-server.columbus.rr.com...
> Tonight I was pulling email from the account I list in my sig (it's a
> disposable account) and got two email's telling me that my email account
> had been deactivated and that the details where in an attached Zip file.
> One thing to note, the account still works fine. Both Zip files were
> different names, but were sent from the same email server.
>
> I called RR and they know nothing about it, I warned them and sent the
> file to security@rr.com so they could be on the lookout for it too.
>
> Now, I'm not anywhere stupid enough to open a passworded Zip file, and
> not stupid enough to fall for this childish crap, but I thought I would
> post this out there in case anyone else gets something like this:
>
> Return-Path: <2484R.M.R.Para9mm@webtv.net>
> Received: from mx3.biz.rr.com ([192.168.201.29]) by fep05.biz.rr.com
>           (InterMail vM.5.01.03.06 201-253-122-118-106-20010523) with
> ESMTP
>           id <20040303044106.IBVS1002.fep05.biz.rr.com@mx3.biz.rr.com>
>           for <spamfree@rrohio.com>; Tue, 2 Mar 2004 23:41:06 -0500
> Received: from Hours (hours.micro.uiuc.edu [128.174.97.18])
> by mx3.biz.rr.com (8.12.10/8.12.10) with SMTP id i234f5U4002896
> for <spamfree@rrohio.com>; Tue, 2 Mar 2004 23:41:05 -0500 (EST)
> Date: Tue, 02 Mar 2004 22:42:21 -0600
> To: spamfree@rrohio.com
> Subject: E-mail account security warning.
> From: management@rrohio.com
> Message-ID: <ttuwrlnaxyaybbrsuvo@rrohio.com>
> MIME-Version: 1.0
> Content-Type: multipart/mixed;
>         boundary="--------xxlqmnigdawgslfadase"
>
> Dear user of Rrohio.com  gateway e-mail server,
>
> Your e-mail  account has been temporary disabled because  of
> unauthorized access.
>
> Please, read the attach for further details.
>
> Attached file protected with the password  for security  reasons.
> Password is  01747.
>
> Kind  regards,
>    The Rrohio.com  team
> http://www.rrohio.com
>
>
> -- 
> --
> spamfree999@rrohio.com
> (Remove 999 to reply to me)
  • Next message: David Mertz, Ph.D.: "Explanation of usage spike (malicious DOS attack?)"

    Relevant Pages

    • Re: Interesting email thread with passworded zip file
      ... My ISP has already posted warnings, ... > disposable account) and got two email's telling me that my email account ... > Subject: E-mail account security warning. ...
      (alt.computer.security)
    • Re: nbc Palin hacker arrested nbc
      ... Wednesday to hacking the e-mail account of Republican vice ... David Kernell, 20, of Knoxville, Tenn. ... The indictment said at least one ...
      (rec.music.artists.springsteen)
    • nbc Palin hacker arrested nbc
      ... Wednesday to hacking the e-mail account of Republican vice ... David Kernell, 20, of Knoxville, Tenn. ... The indictment said at least one ...
      (rec.music.artists.springsteen)
    • Re: Outlook 2003 sending via exchange instead of pop3
      ... Becuase Exchange supports the SMTP namespace (as does Internet mail). ... If you have set up multiple e-mail accounts (e-mail account: ... Why is exchange set as the> account to send though, when the original email did no come though Exchange at all? ...
      (microsoft.public.outlook)
    • Re: Outlook 2003 sending via exchange instead of pop3
      ... Becuase Exchange supports the SMTP namespace (as does Internet mail). ... If you have set up multiple e-mail accounts (e-mail account: ... Why is exchange set as the> account to send though, when the original email did no come though Exchange at all? ...
      (microsoft.public.exchange.clients)
    • Quantcast