Worm bait?

[nmeyers at javalinux.net (nmeyers at javalinux.net)]

On Tue, Aug 19, 2003 at 08:33:34PM -0400, Robert L Krawitz wrote:
>    From: Stephen Anthony <steve at stephencanthony.com>
>    Date: 19 Aug 2003 19:55:39 -0400
> 
>    I received a email from a postfix mailer that tells me the message I
>    sent bounced. All well and good, except I didn't send the message to
>    begin with. Also, it says it was sent from my old attbi.com address
>    (correct user name, tho) which I haven't used in a few months.
> 
>    I'm running my Evolution as my mail client, if that matters. 
> 
>    I'm concerned that someone may have gotten access to the attbi account
>    and is sending mail as me. 
> 
>    Things I should do to investigate?
> 
> I've received a ton of these today.  I think that the latest worm de
> l'heur is particularly aggressive at scanning systems for email
> addresses and randomly using one as the sender.

I second that. I've gotten a lot of "you sent us a virus, you bastard"
emails today, plus a note from weddingchannel.com thanking me for my
interest in their services :-). The emails are definitely not coming
from my system or my hosting provider.

Nathan Meyers
nmeyers at javalinux.net