Mysterius emails

6 Jun 2006 7:07 PM

Mary

Hi,

Anyone know what this is about;

Getting funky emails with a number in the subject line, like 445. The
subject line changes, but the body text is always the same: 5556.

I have several users here in our office that have received them, often
"from" themselves... I also heard from friends that they have seen them as
well (not from me, but from users within their own domain...)

There is no obvious attachment in the email and our virus protection could
care less. ;-)

I checked with Symantec but they have nothing noted on it, at least not
yet... or I can't find it.

Thanks,

Mary

6 Jun 2006 7:33 PM

Ben M. Schorr - MVP

Aloha Mary,

Could be a virus, worm or spambot that has gone wrong and not correctly attached
the virus/worm or other payload.

-Ben-
Ben M. Schorr - MVP
http://www.rolandschorr.com
Microsoft OneNote FAQ: http://www.factplace.com/onenotefaq.htm

Show quote

> Hi,
>
> Anyone know what this is about;
>
> Getting funky emails with a number in the subject line, like 445. The
> subject line changes, but the body text is always the same: 5556.
>
> I have several users here in our office that have received them, often
> "from" themselves... I also heard from friends that they have seen
> them as well (not from me, but from users within their own domain...)
>
> There is no obvious attachment in the email and our virus protection
> could care less. ;-)
>
> I checked with Symantec but they have nothing noted on it, at least
> not yet... or I can't find it.
>
> Thanks,
>
> Mary
>

6 Jun 2006 8:09 PM

sspenning

We're seeing them in Central Illinois too. I'm noticing a LOT of
chatter about elevated spam levels across the net. Anyone observing
any common vectors?

Ben M. Schorr - MVP wrote:
Show quote

> Aloha Mary,
>
> Could be a virus, worm or spambot that has gone wrong and not correctly attached
> the virus/worm or other payload.
>
> -Ben-
> Ben M. Schorr - MVP
> http://www.rolandschorr.com
> Microsoft OneNote FAQ: http://www.factplace.com/onenotefaq.htm
>
> > Hi,
> >
> > Anyone know what this is about;
> >
> > Getting funky emails with a number in the subject line, like 445. The
> > subject line changes, but the body text is always the same: 5556.
> >
> > I have several users here in our office that have received them, often
> > "from" themselves... I also heard from friends that they have seen
> > them as well (not from me, but from users within their own domain...)
> >
> > There is no obvious attachment in the email and our virus protection
> > could care less. ;-)
> >
> > I checked with Symantec but they have nothing noted on it, at least
> > not yet... or I can't find it.
> >
> > Thanks,
> >
> > Mary
> >

7 Jun 2006 12:23 PM

Michael Bednarek

On Tue, 6 Jun 2006 12:07:06 -0700, Mary wrote in
microsoft.public.exchange.misc:

Show quote

>Anyone know what this is about;
>
>Getting funky emails with a number in the subject line, like 445. The
>subject line changes, but the body text is always the same: 5556.
>
>I have several users here in our office that have received them, often
>"from" themselves... I also heard from friends that they have seen them as
>well (not from me, but from users within their own domain...)
>
>There is no obvious attachment in the email and our virus protection could
>care less. ;-)
>
>I checked with Symantec but they have nothing noted on it, at least not
>yet... or I can't find it.

Same here. It seems a small trickle; I got one, and I know that our MD
got one, both as you describe with a fake From: of the respective
recipients and 5556 as the only text in the body in his, in mine the
text was 969.

There's definitely no attachment, so AV programs have nothing to do. I
checked the headers of the message I received (the MD didn't forward
his), and the only identifiable IP address was registered with Polish
Telekom. Here is the only Received: line from the headers:

Received: from MonikaMaka.org ([83.15.52.62]) by mail3.tgm.com.au with
Microsoft SMTPSVC(6.0.3790.1830); Tue, 6 Jun 2006 19:26:12 +1000

The assumed Polish origin fits with this line:

Date: Tue, 06 Jun 2006 10:43:07 +0100

(It seems the clock at 83.15.52.62 is off; I take it that 10:43 +0100 is
after 19:26 +1000)

The Internet has no record of MonikaMaka and only a dozen or so of
"Monika Maka", fittingly enough most of them from Poland. I should point
out that my surname is also of Polish origin. I have about half a dozen
e-mail alias addresses, and the one used in this message was the one
which has only my surname before the at sign.

Mysterious indeed.

--
Michael Bednarek http://mbednarek.com/ "POST NO BILLS"

7 Jun 2006 12:56 PM

Eric W

5 companies I support have users reporting similar emails in the past 48
hours.

7 Jun 2006 8:49 PM

Jim

We have been getting them as well, and we use a 3rd party spam/av service to
scan our emails. I talked to their tech support and they've been getting alot
of calls on this from other domains. No word as to why these are occuring,
one speculation is that someone is "testing" to see if they can get them
through for a future payload attempt. Ouch.

Show quote

"Mary" wrote:

> Hi,
>
> Anyone know what this is about;
>
> Getting funky emails with a number in the subject line, like 445. The
> subject line changes, but the body text is always the same: 5556.
>
> I have several users here in our office that have received them, often
> "from" themselves... I also heard from friends that they have seen them as
> well (not from me, but from users within their own domain...)
>
> There is no obvious attachment in the email and our virus protection could
> care less. ;-)
>
> I checked with Symantec but they have nothing noted on it, at least not
> yet... or I can't find it.
>
> Thanks,
>
> Mary
>
>
>