Weird email messages with "re:movie" and "re:application" in the subject line..

Thu Jun 26 15:24:06 UTC 2003

On Thu, 26 Jun 2003, McBurnett, Jim wrote:

> Date: Thu, 26 Jun 2003 09:33:16 -0400
> From: "McBurnett, Jim" <jmcburnett at msmgmt.com>
> To: nanog at merit.edu
> Subject: RE: Weird email messages with "re:movie" and "re:application" in
>     the	subject line..
>
>
> got it here too..
> And on 30+ publicly annouced mail accounts....
> Hitting big.. sobig virus once again...
>
> Jim

Jim, All

Just in the last hour itself, I must have had at least 5 E.mails come to
me with a certain 'zipped' file attached, from persons unknown -- who have
received E.mails from me with the subject title in question.

In each case, the following message, and others of a similar nature were
enclosed.

> The file attachment your_details.zip (details.pif) you sent to the
> recipients listed above was infected with the W32/Sobig.e at MM virus and
> was deleted.

It appears that whomever they are, the perpetrators are using a common
spamming technique to harvest addresses from the net for example, and to
then use that information to spoof the receivers.  I say this because in
at least 3 of the 5 cases to which I refer, the ORIGINATING address is an
older convention (while it still works) that we no longer use at the
University of Hawai'i.  Consequently, this leads me to suspect harvesting
of dated addresses from the net.

Just another experience...

Regards,
Robert.