[sdiy] Help - I am being mailbombed

[James Patchell]

I got a small flood of these myself last night.  (only about 4, but within 
a very short time).

At 12:22 PM 8/29/2003 -0400, Les Mizzell wrote:
>::  I have a serious problem - someone is literally mailbombing me.
>
>
>Hi,
>
>This all appears to be the output of the SoBig virus.
>
>Info from Symantec:
>http://securityresponse.symantec.com/avcenter/venc/data/w32.sobig.a@mm.html
>
>
>It's pretty nasty, because it will FAKE headers when sending out stuff, and
>also send out viris warnings as well, with itself attached of course....
>
>A friend of mine was getting close to 100 of these and hour for a few days
>last week....
>
>
>
>::  4 of these mail headers:
>::
>::  Return-Path: <djalone at houston.rr.com>
>::  Delivered-To: jhaible at debitel.net
>::  Received: (qmail 14777 invoked from network); 29 Aug 2003 16:33:40 +0200
>::  Received: from unknown (HELO LTERPENING) (68.153.49.25)
>::    by mail2.dnsg.net with SMTP; 29 Aug 2003 16:33:40 +0200
>::  From: <djalone at houston.rr.com>
>::  To: <jhaible at debitel.net>
>::  Subject: Re: Re: My details
>::  Date: Fri, 29 Aug 2003 9:36:02 --0500
>::  X-MailScanner: Found to be clean
>::  Importance: Normal
>::  X-Mailer: Microsoft Outlook Express 6.00.2600.0000
>::  X-MSMail-Priority: Normal
>::  X-Priority: 3 (Normal)
>::  MIME-Version: 1.0
>::  Content-Type: multipart/mixed;
>::      boundary="_NextPart_000_24DA31A0"
>::  Message-ID: <20030829143340.13930.qmail at mail2.dnsg.net>
>::
>::
>::  Return-Path: <Hobbyha at aol.com>
>::  Delivered-To: jhaible at debitel.net
>::  Received: (qmail 14801 invoked from network); 29 Aug 2003 16:56:53 +0200
>::  Received: from unknown (HELO LTERPENING) (68.153.49.25)
>::    by mail2.dnsg.net with SMTP; 29 Aug 2003 16:56:53 +0200
>::  From: <Hobbyha at aol.com>
>::  To: <jhaible at debitel.net>
>::  Subject: Re: Wicked screensaver
>::  Date: Fri, 29 Aug 2003 9:59:15 --0500
>::  X-MailScanner: Found to be clean
>::  Importance: Normal
>::  X-Mailer: Microsoft Outlook Express 6.00.2600.0000
>::  X-MSMail-Priority: Normal
>::  X-Priority: 3 (Normal)
>::  MIME-Version: 1.0
>::  Content-Type: multipart/mixed;
>::      boundary="_NextPart_000_24EF7431"
>::  Message-ID: <20030829145653.14160.qmail at mail2.dnsg.net>
>::
>::
>::  Return-Path: <marty.welch at dana.com>
>::  Delivered-To: jhaible at debitel.net
>::  Received: (qmail 15650 invoked from network); 29 Aug 2003 17:21:19 +0200
>::  Received: from unknown (HELO LTERPENING) (68.153.49.25)
>::    by mail1.dnsg.net with SMTP; 29 Aug 2003 17:21:19 +0200
>::  From: <marty.welch at dana.com>
>::  To: <jhaible at debitel.net>
>::  Subject: Re: Your application
>::  Date: Fri, 29 Aug 2003 10:23:41 --0500
>::  X-MailScanner: Found to be clean
>::  Importance: Normal
>::  X-Mailer: Microsoft Outlook Express 6.00.2600.0000
>::  X-MSMail-Priority: Normal
>::  X-Priority: 3 (Normal)
>::  MIME-Version: 1.0
>::  Content-Type: multipart/mixed;
>::      boundary="_NextPart_000_2505D263"
>::  Message-ID: <20030829152119.15329.qmail at mail1.dnsg.net>
>::
>::
>::  Return-Path: <marty.welch at dana.com>
>::  Delivered-To: jhaible at debitel.net
>::  Received: (qmail 15650 invoked from network); 29 Aug 2003 17:21:19 +0200
>::  Received: from unknown (HELO LTERPENING) (68.153.49.25)
>::    by mail1.dnsg.net with SMTP; 29 Aug 2003 17:21:19 +0200
>::  From: <marty.welch at dana.com>
>::  To: <jhaible at debitel.net>
>::  Subject: Re: Your application
>::  Date: Fri, 29 Aug 2003 10:23:41 --0500
>::  X-MailScanner: Found to be clean
>::  Importance: Normal
>::  X-Mailer: Microsoft Outlook Express 6.00.2600.0000
>::  X-MSMail-Priority: Normal
>::  X-Priority: 3 (Normal)
>::  MIME-Version: 1.0
>::  Content-Type: multipart/mixed;
>::      boundary="_NextPart_000_2505D263"
>::  Message-ID: <20030829152119.15329.qmail at mail1.dnsg.net>

         -Jim
***************************************************
I'm a man
But I can change
If I have to
I guess.

Man's Prayer
Red Green

***************************************************

http://members.cox.net/patchell

***************************************************