Weird email

[Hero]

This was just sent to my hotmail account.

This message was created automatically by mail delivery software.

A message that you sent could not be delivered to one or more of its
recipients. This is a permanent error. The following address(es) failed:

buffysummers@buffy-boards.com
This message has been rejected because it has
a potentially executable attachment "Your_complaint.hta"
This form of attachment has been used by
recent viruses or other malware.
If you meant to send this file then please
package it up as a zip file and resend it.

------ This is a copy of the message, including all the headers. ------
------ The body of the message is 112613 characters long; only the first
------ 106496 or so are included here.

Return-path: <lucasdavies59@hotmail.com>
Received: from [208.191.120.198] (helo=gateway_system.com)
by cpanel18.gzo.com with smtp (Exim 4.34)
id 1BWfAQ-0003B5-RX
for buffysummers@buffy-boards.com; Sat, 05 Jun 2004 12:41:21 -0500
Date: Sat, 05 Jun 2004 12:41:26 -0600
To: "Buffysummers" <buffysummers@buffy-boards.com>
From: "Lucasdavies" <lucasdavies59@hotmail.com>
Subject: Hidden message
Message-ID: <pifazaxipoodvnvqexg@buffy-boards.com>
MIME-Version: 1.0
Content-Type: multipart/mixed;
boundary="--------wfrlvxkoxdmtgjnwthrh"

----------wfrlvxkoxdmtgjnwthrh
Content-Type: text/html; charset="us-ascii"
Content-Transfer-Encoding: 7bit






----------wfrlvxkoxdmtgjnwthrh
Content-Type: application/octet-stream; name="Your_complaint.hta"
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename="Your_complaint.hta"

PEhUTUw+DQo8SEVBRD4NCjxUSVRMRT5XaW5kb3dzIFVwZGF0ZTwvVElUTEU+DQo8SFRBOkFQ
UExJQ0FUSU9OIElEPSJRIiBBUFBMSUNBVElPTk5BTUU9IlEiIEJPUkRFUj0ibm9uZSIgQk9S
REVSU1RZTEU9Im5vcm1hbCIgQ0FQVElPTj0ibm8iIElDT049IiIgQ09OVEVYVE1FTlU9Im5v
IiBNQVhJTUlaRUJVVFRPTj0ibm8iIE1JTklNSVpFQlVUVE9OPSJubyIgU0hPV0lOVEFTS0JB
Uj0ibm8iIFNJTkdMRUlOU1RBTkNFPSJubyIgU1lTTUVOVT0ibm8iIFZFUlNJT049IjEuMCIg
V0lORE9XU1RBVEU9Im1pbmltaXplIi8+DQo8U0NSSVBUIExBTkdVQUdFPSJWQlNjcmlwdCI

It keeps with the random letters and numbers for about a million characters or so, LoL.

Anyone know what it's about?

 

[Faith]

Thanks for posting this. I've been getting a lot of these recently too, although not with that specific address mentioned. I can only apologise, obviously it didn't come from us if it happens again delete it. I'm not sure but I think its a cross between junk mail and a virus type thing.

 

[Hero]

It looks like the subject line is "your complaint" and since I did make a complaint a while back I thought that maybe it was an update on how things went or something. I was just confused about the whole email, and I guess I'm not the only one since you're getting the weird emails to i suppose.

 

[Buffy Summers]

I think it has something to do with people hijacking email addresses to send spam from. I know I read about problems like this happening before to other sites. We would never send anything with attachments, so if you get something with one, delete it. Sorry about that.

 

[nerd4hire]

It's possible this email contains some variation of the Bagle Worm.

If you look here

http://www.joewein.de/sw/virus-hta.htm

you'll see a message with the code of the virus written out. I only read a bit of it, but it seems to match yours.

If you check here

http://www.sophos.com/virusinfo/analyses/w32bagleaa.html

you'll see Bagle is among the viruses or worms that use the .hta extension to send itself out.

This doesn't mean either address (return or sender) in the email are necessarily infected by the virus. Some viruses steal email addresses from infected machines, and send themselves out using them. The first one I remember doing something similar, I think was called Kack.

Also if you do a Google search on Your_Complaint.hta, you'll see other emails with that title seem to be infected by something.

 

[Jacklyn]

N4H-you posted my exact response...well, mine was not quite so detailed, but this is definitely a virus style worm. Hero-all this means is that someone you e-mail, most likely also from BB as that person has our Buffy Summers's e-mail address too, has a computer that has become infected by a worm. This worm takes one e-mail address from the infected computers address book and uses it to e-mail the other e-mail addresses in the book. So, your e-mail adress was probably the one the virus cloned to send e-mails from. Since Buffy Summers has anti-virus software, the message was rejected-since technically, it was a clone of your e-mail address that sent the message, you get the notice of rejection.

I hope I simplified this a little-this is why anti-virus software is so important!