IP: a *nasty* spam scam of the day <grrrr>

[Dave Farber <farber () cis upenn edu>]

> X-Sender: ">jwarren () mail well com
> Date: Fri, 3 Mar 2000 15:11:03 -0800
> To: ">farber () cis upenn edu (Dave Farber)
> From: Jim Warren <">jwarren () well com>
> Subject: a *nasty* spam scam of the day  <grrrr>
>
> I received the suspicious message at the bottom, and forwarded it to a
> net-geek friend who's been working on spam protection, full time, asking
> him what he thought of it.  He checked it out and responded:
>
> > Yup...  when I went to the site (from my UNIX box I should say) I got...
> >
> > --
> > REGEDIT4
> >
> > [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
> > "Start Page" = "http://www.globesearch.com";
> > --
> >
> > Hmmm... does this edit the registry under windows to change your
> > start page?  What else can it do?
> >
> > Nasty!
>
>
> =======
>
>
> The suspicious message:
>
> > On Fri, Mar 03, 2000 at 09:08:17AM -0800, Jim Warren wrote:
> > > > From: ">mynet () istar ca
> > > > Received: from mail1.toronto.istar.net (mail1.toronto.istar.net
> > > > [209.89.75.17])
> > > >          by smtp.well.com (8.8.5/8.8.4) with ESMTP
> > > >      id EAA23976 for <">jwarren () well com>; Fri, 3 Mar 2000 04:20:33
> > > > -0800 (PST)
> > > > Received: from ip237.halifax9.dialup.canada.psi.net ([154.5.34.237]
> > > > helo=istar.ca)
> > > >    by mail1.toronto.istar.net with smtp (Exim 2.02 #1)
> > > >    id 12QqQ4-0003gU-00; Fri, 3 Mar 2000 06:38:57 -0500
> > > > To: ">mynet () istar ca
> > > > Subject: STOP UNWANTED EMAIL ADS
> > > > Message-Id: <E12QqQ4-0003gU-00 () mail1 toronto istar net>
> > > > Date: Fri, 3 Mar 2000 06:38:57 -0500
> > > > X-UIDL: e336accbc4da158c85ed203acb513895
> > > >
> > > >
> > > > ---------------------------------------------------------------------- 
> ----
> > > > YOU WILL BE REMOVED FROM 1579 BULK EMAILERS.
> > > > global filter click here  AND "SELECT OPEN IN THIS LOCATION"
> > > > http://www.freeinternetservices.com/default.reg
> > > > -------------------------------------------------------------------------
> > > >
> > > > YOU WILL BE REMOVED FROM 1579 BULK EMAILERS.
> > > >
> > > > Now you can stop unwanted email ads with just 3 clicks with
> > > > freeinternetservices.com
> > > > filter file. This will cut down on all the unwanted email ads that you
> > > > hate getting every day!!!
> > > >
> > > > CLICK ON THE URL AND FOLLOW THE DIRECTIONS BELOW......
> > > >
> > > > simply SELECT " OPEN FILE IN CURRENT LOCATION "
> > > > then click YES  then click OK.
> > > >
> > > > http://www.spamfilters.com/default.reg
> > > >
> > > > this is a beta version of THIS IS A GLOBAL FILTER FILE.
> > > > THIS IS A 1K FILE.
> > > >
> > > > http://www.freeinternetservices.com/default.reg
> > > >
> > > > PLEASE PASS THIS ON TO YOUR FRIENDS THAT HATE JUNK EMAIL.
> > > > THANKS.