For security purposes!

[Guru]

X-Original-To: hekkuli@hekkuli.org
To: hekkuli@hekkuli.org
Subject: E-mail account security warning.
From: noreply@hekkuli.org

[-- Attachment #1 --]
[-- Type: text/plain, Encoding: 7bit, Size: 0,5K --]

Dear user of Hekkuli.org,

Some of our clients complained about the spam (negative e-mail content)
outgoing from your e-mail account. Probably, you have been infected by
a proxy-relay trojan server. In order to keep your computer safe,
follow the instructions.

Pay attention on attached file.

For security purposes the attached file is password protected. Password is "81663".

Sincerely,
The Hekkuli.org team http://www.hekkuli.org

[SpiralDragon]

had a similar one

dear user of "Mcdragon.net" mailing system,

We warn you about some attacks on your e-mail account. Your computer may contain viruses, in order to keep your computer and e-mail account safe, please, follow the instructions.

For further details see the attach.

Kind regards,
The Mcdragon.net team http://www.mcdragon.net

Norton AntiVirus removed the attachment: Info.pif.
The W32.Beagle.A@mm threat was detected in the attachment.

well mcdragon.net is my OWN domain name ....... and i surly did not send this to myself...

[schmosef]

Re: For security purposes!

I just got the exact same email as you Guru. All of the text was the same except for the website references. I don't know what your connection to Hekkuli.org is but the email claimed it was from the administrator of a website (and web server) that I myself happen to administrate.

I was pissed. But what can I do. Spammers are spammers. Password protecting the attached zip file seems like a new tactic. I guess it delays anti-virus scanners from finding the viruses and circumvents anti-virus scanning at the mail server level.

[Guru]

I did not get this e-mail myself!

[Wombat]

I got one that forged my own domain. Ha, fooled them! I don't call my administrator account "administrator."

[schmosef]

I just got it again for a different domain that I administrate. It's such a nuicance. What kind of person does this?

[ZokesPro]

I do tech support for a popular Quebec ISP and we've been getting tons of calls about emails being sent like that with my company's email written in it. Every other call I get I have to tell the customer to delete it, it's getting real annoying.

Stupid virus.

[Brian Ellis]

This kind of spoofing is becoming a real plague. I've told my Bayesian filtering system that these are spam, so I never see them now.

If your ISP will allow it, you can often set up a filter that mail from e.g., *@hekkuli.org is deleted. Do not set it up to be bounced, though, otherwise you may set up an endless loop that may cause DoS for real mail, as well as needlessly reducing Internet bandwidth..