[LUNI] curious emails and even curiouser replies

[Timothy R. Geier]

On Thu, Jun 26, 2003 at 10:56:58AM -0500, jean at kcco.com wrote:
> Greetings,
> 
> I appear to be getting some odd emails indicative of a worm seeking to spread
> itself.
> 
> What is disturbing is that the emails are replies from the USPTO addressed to
> me, implying that they are responding with the assumption that the original mail
> came from me!  This is particularly worrying as (a) they are a government agency
> (and one I have been very critical of publicly) and (b) the attached zip file
> appears to contain a .pif file that may contain a trojan/worm (I'm no expert on
> trojans and worms per se, having as little to do with Windows and microsloth
> software as humanely possible).  Examinations under linux of the file in
> question didn't reveal anything readily apparent, but since I've received 3 of
> these messages on a relatively secret account (which has thus been kept
> spam-free), I am wondering what is going on.
> 
> Does anyone else have any experience with this type of worm?  I'm assuming it is
> fairly widespread, and my living and working in GNU/Linux bliss has mitigated my
> exposure to this nonsense previously.
> 
> Any insights and pointers to more information would be greatly appreciated.
> 
> regards,
> 
> Jean.
> 

[snip] This is the "Sobig.e" worm that was announced yesterday and has
been rapidly propogating.  I have seen three instances of it in the last
24 hours, which is very high for where I work.  The following link has
more information:

http://securityresponse.symantec.com/avcenter/venc/data/w32.sobig.e@mm.html 

> ----Your----Original----Message----
> >From : jean-michel at kcco.com
> Date : Wed, 25 Jun 2003 19:44:20 -0400
> To: TrademarkAssistanceCenter at uspto.gov
> Cc:
> Subject : Re: Movie
> 
> Please see the attached zip file for details.
> 
> [snip]
> ______________________________________________________________________
> Linux Users Of Northern Illinois - Technical Discussion 
> luni at luni.org
> http://luni.org/mailman/listinfo/luni

-- 
Timothy R. Geier 
tgeier at speakeasy dot net