Brought to you this hour by

Advertising and Web Hosting on Woodwind.Org!

Doublereed Archive - Posting 000044.txt from 2004/02

From: Dennis Thiel <dathiel@-----.au>
Subj: Re: [DR-L] MyDoom has reached DR-L.
Date: Sun, 8 Feb 2004 17:23:33 -0500

My initial message on this subject was simply a warning with advice, nothing
more.

The point was that MyDoom sends out random attachments which by name are ALL
seemingly normal and legitimate ... the trick is to recognize the unusual
message format and NOT open the attachment.

One should never open an attachment from a stranger or strange address or from a
known address with a strange message. When sending attachments, they should be
described in some detail within the message.

Most interestingly, the original MyDoom propagated message came as if through
DR-L, not as if directly from Edwin.

Dennis.

----------------------------------------------------------------------------

Rebecca Hartong wrote:

> One of the really insidious things about these viruses/trojan horses is that
> they'll grab an email address from the address book of the infected computer
> and use that stolen email address as the "from" address when they send
> themselves out to other people. Many of you have probably already received
> "mail returned as undeliverable" sorts of messages indicating that you sent
> some sort of email to a person you've never heard of. What's happened is
> that the virus/trojan horse stole ~your~ email address from someone else's
> computer and is using it to multiply! This happens even when your own
> computer is virus-free.
>
> As to the "winmail.dat" file...isn't this just a sort of 'business card'
> attachment for email?
>
> Rebecca Hartong
>
> DOUBLEREED-L mailing list
> DOUBLEREED-L@-----.edu
> http://lists.washburn.edu/mailman/listinfo/doublereed-l