Re: [DMCForum] Re: counterfeit e-mail

[Marc Levy <malevy_nj@xxxxxxxxx>]

Just re-read this message below.. Here is what
happened:

Someone on the list has the virus.  They sent the
virus TO me (at my old address) FROM you!  The servers
@ Bell-Labs rejected the message because I am no
longer there, and sent the NDR to you so that you
would know that I did not get the message.

What sucks is, the NDR does not include the IP address
from which the message orgiginated from!  So, this
does us no good in finding the person with the virus..
 However, the person with the virus has some OLD mail
from me in their inbox because I left Bell-Labs in
April 2001!

--- Walter Coe <Whalt@xxxxxxx> wrote:
> Okay, if anyone likes to figure out IP addresses,
> here's the bounced e-mail:
> Walt
> ----------------------
> 
> Received: from dirty.research.bell-labs.com
> ([204.178.16.6])
>           by worldnet.att.net (mtiwmxc18) with ESMTP
>           id <2004041509070001800lqdjpe>; Thu, 15
> Apr 2004 09:07:00 +0000
> X-Originating-IP: [204.178.16.6]
> Received: from grubby.research.bell-labs.com
> (H-135-104-2-9.research.bell-labs.com [135.104.2.9])
>  by dirty.research.bell-labs.com (8.12.10/8.12.10)
> with ESMTP id i3F970xZ030796
>  for <whalt@xxxxxxx>; Thu, 15 Apr 2004 05:07:00
> -0400 (EDT)
> Received: from localhost (localhost)
>  by grubby.research.bell-labs.com (8.12.9/8.12.9) id
> i3F96tfL094856;
>  Thu, 15 Apr 2004 05:06:55 -0400 (EDT)
> Date: Thu, 15 Apr 2004 05:06:55 -0400 (EDT)
> From: Mail Delivery Subsystem
> <MAILER-DAEMON@xxxxxxxxxxxxxxxxxxxxxx>
> Message-Id:
>
<200404150906.i3F96tfL094856@xxxxxxxxxxxxxxxxxxxxxxxxxxxxx>
> To: <whalt@xxxxxxx>
> MIME-Version: 1.0
> Content-Type: multipart/report;
> report-type=delivery-status;
> 
>
boundary="i3F96tfL094856.1082020015/grubby.research.bell-labs.com"
> Subject: Returned mail: see transcript for details
> Auto-Submitted: auto-generated (failure)
> 
> This is a MIME-encapsulated message
> 
>
--i3F96tfL094856.1082020015/grubby.research.bell-labs.com
> 
> The original message was received at Thu, 15 Apr
> 2004 05:06:54 -0400 (EDT)
> from dusty.research.bell-labs.com [135.104.2.7]
> 
>    ----- The following addresses had permanent fatal
> errors -----
> <malevy@xxxxxxxxxxxxxxxxxx>
>     (reason: 550 <malevy@xxxxxxxxxxxxxxxxxx>... User
> unknown)
> 
>    ----- Transcript of session follows -----
> ... while talking to chair.dnrc.bell-labs.com.:
> >>> RCPT To:<malevy@xxxxxxxxxxxxxxxxxx>
> <<< 550 <malevy@xxxxxxxxxxxxxxxxxx>... User unknown
> 550 5.1.1 <malevy@xxxxxxxxxxxxxxxxxx>... User
> unknown
> 
>
--i3F96tfL094856.1082020015/grubby.research.bell-labs.com
> Content-Type: message/delivery-status
> 
> Reporting-MTA: dns; grubby.research.bell-labs.com
> Received-From-MTA: DNS; dusty.research.bell-labs.com
> Arrival-Date: Thu, 15 Apr 2004 05:06:54 -0400 (EDT)
> 
> Final-Recipient: RFC822; malevy@xxxxxxxxxxxxxxxxxx
> Action: failed
> Status: 5.1.1
> Remote-MTA: DNS; chair.dnrc.bell-labs.com
> Diagnostic-Code: SMTP; 550
> <malevy@xxxxxxxxxxxxxxxxxx>... User unknown
> Last-Attempt-Date: Thu, 15 Apr 2004 05:06:54 -0400
> (EDT)
> 
>
--i3F96tfL094856.1082020015/grubby.research.bell-labs.com
> Content-Type: message/rfc822
> 
> Return-Path: <whalt@xxxxxxx>
> Received: from dusty.research.bell-labs.com
> (dusty.research.bell-labs.com [135.104.2.7])
>  by grubby.research.bell-labs.com (8.12.9/8.12.9)
> with ESMTP id i3F96sfL094854
>  for <malevy@xxxxxxxxxxxxxxxxxx>; Thu, 15 Apr 2004
> 05:06:54 -0400 (EDT)
> Received: from dnrc.bell-labs.com
> (host81-136-142-48.in-addr.btopenworld.com
> [81.136.142.48])
>  by dusty.research.bell-labs.com (8.12.10/8.12.10)
> with ESMTP id i3F9GDF4008269
>  for <malevy@xxxxxxxxxxxxxxxxxx>; Thu, 15 Apr 2004
> 05:16:14 -0400 (EDT)
> Message-Id:
>
<200404150916.i3F9GDF4008269@xxxxxxxxxxxxxxxxxxxxxxxxxxxx>
> From: whalt@xxxxxxx
> To: malevy@xxxxxxxxxxxxxxxxxx
> Subject: Re: Word file
> Date: Thu, 15 Apr 2004 10:06:44 +0100
> MIME-Version: 1.0
> Content-Type: multipart/mixed;
> 
> boundary="----=_NextPart_000_0004_000013AB.0000228D"
> X-Priority: 3
> X-MSMail-Priority: Normal
> 
> This is a multi-part message in MIME format...
> 
> ------=_NextPart_000_0004_000013AB.0000228D
> Content-Type: text/plain;
>  charset="Windows-1252"
> Content-Transfer-Encoding: 7bit
> 
> Your document is attached.
> 
> ------=_NextPart_000_0004_000013AB.0000228D
> Content-Type: text/plain
> Content-Disposition: inline
> 
> This email contained a file name document_word.pif.
> As the extension
> pif can be executed automatically by most email
> clients on windows
> and can be used to spread viruses, we do not allow
> these extensions
> to pass through our email gateway. If you really
> need this file, please
> contact the sender to zip the file and send it to
> you.
> 
> Sorry for the inconvenience.
> ------=_NextPart_000_0004_000013AB.0000228D--
> 
>
--i3F96tfL094856.1082020015/grubby.research.bell-labs.com--
> 
> 
> [Non-text portions of this message have been
> removed]
> 
> 
> 
> ------------------------ Yahoo! Groups Sponsor



	
		
__________________________________
Do you Yahoo!?
Yahoo! Tax Center - File online by April 15th
http://taxes.yahoo.com/filing.html


------------------------ Yahoo! Groups Sponsor ---------------------~-->
Yahoo! Autos. Everything you need to know about buying 
or selling a car.  FREE Quotes, 360° Tours, Research,
Blue Book, Compare Vehicles, Buy Used
http://us.click.yahoo.com/kEZsdA/bwnGAA/YiGOAA/HliolB/TM
---------------------------------------------------------------------~->

 
Yahoo! Groups Links

<*> To visit your group on the web, go to:
     http://groups.yahoo.com/group/DMCForum/

<*> To unsubscribe from this group, send an email to:
     DMCForum-unsubscribe@xxxxxxxxxxxxxxx

<*> Your use of Yahoo! Groups is subject to:
     http://docs.yahoo.com/info/terms/