Spam from _sring_at_uslink.net?

From: Bill Dawson <whdawson_at_mlynk.com>
Date: Thu Nov 29 11:03:16 2001

S. Ring, IIRC, is Stephanie Ring. She is/was a list member.

I'm using Outlook 2000 with the latest Microslop patches/security updates
and the latest version of ZoneAlarm, 2.6.357, so I avoided infection.

Since the attachment was quarantined, the email I received has a seemingly
blank body and no apparent attachment. The subject line is:

Re: RE: SWTPc and Microdata (WARNING - LONG EMAIL STILL),

which is a reply to an email I sent over a year ago to Jay West (hello,
Jay), which he replied to by sending a new email with a different subject
line. I'm guessing that Jay still had my original unreplied to email?

Checking the properties of the this email does show "size: 30KB (Contains 1
included file(s))".

And, here's the header from the email, however I xz-munged the email
addresses. Note the underscore in the "From:":

Return-Path: <xwest_at_xtseinc.com>
Received: from opal.tseinc.com (opal.tseinc.com [209.83.143.19])
        by mlynk.com (8.9.3/8.9.3) with ESMTP id VAA14949
        for <zwhdawson_at_mlynkz.com>; Wed, 28 Nov 2001 21:59:38 -0500
Received: from aol.com (user_at_stl-26.tseinc.com [209.83.137.26])
        by opal.tseinc.com (8.9.3/8.9.3) with SMTP id TAA73484
        for <zwhdawson_at_mlynkz.com>; Wed, 28 Nov 2001 19:36:03 -0600 (CST)
        (envelope-from xwest_at_xtseinc.com)
Date: Wed, 28 Nov 2001 19:36:03 -0600 (CST)
Message-Id: <200111290136.TAA73484_at_opal.tseinc.com>
From: "Jay West" <_xwest_at_xtseinc.com>
To: zwhdawson_at_mlynkz.com
Subject: Re: RE: SWTPc and Microdata (WARNING - LONG EMAIL STILL)
MIME-Version: 1.0
Content-Type: multipart/related;
         type="multipart/alternative";
         boundary="====_ABC1234567890DEF_===="
X-Priority: 3
X-MSMail-Priority: Normal
X-Unsent: 1
Status:


My sister wasn't so lucky in avoiding the hit, so I'll have to go clean up
her system. The infected email in her case came from an eBay user. BTW,
FWIW, S. Ring is or was an eBay member.

'til next time,

Bill

-> On Wed, Nov 28, 2001 at 03:36:25PM -0800, Fred Cisin (XenoSoft) wrote:
-> > This one, the "payload" was in:
-> > README.mp3.scr
-> > I've also gotten earlier today from other mails a couple with a payload
-> > named:
-> > SM3SONG.mp3.scr
Received on Thu Nov 29 2001 - 11:03:16 GMT