HELP email problem

[LiLPerronis]

i got this in a email today is this a bull shit scam or true?????HELP



-----------------------
This e-mail is generated by the mx1.skyinet.net mail server to warn you that the
e-mail
sent by [email protected] to [email protected] is infected with
virus: Win32/Sobig.F@mm.

Please contact your system administrator for further information.

If you are the sender:
-------------------
The scanned e-mail has your address in the <From> header field. Either your
computer is infected or someone's computer having your e-mail address in
the address book has been infected.

(Please note that some viruses are sending e-mails directly from your computer.
Our advise is to check your computer using an up-to-date antivirus product).

Actions taken for the infected files:
-------------------------------------

The infected file was saved to quarantine with name: 1062556444-RAV18868.
The file (part0002:movie0045.pif) attached to mail (with subject:Re: Wicked
screensaver) sent by [email protected] to [email protected]
is infected with virus: Win32/Sobig.F@mm.
Cannot clean this file.
The mail was not delivered since it contained dangerous code.

------------------------
this is a copy of the e-mail header:

Received: from KENNY (c-67-168-233-61.client.comcast.net [67.168.233.61])
by mx1.skyinet.net (Postfix) with ESMTP id A1D6A5C011
for <[email protected]>; Wed, 3 Sep 2003 10:33:51 +0800 (PHT)


RAV AntiVirus for Linux i386 version: 8.4.0 (snapshot-20020919)

Scan engine 8.11 for i386.
Last update: Tue, 02 Sep 2003 21:32:02 +08
Scanning for 81709 malwares (viruses, trojans and worms).

[LiLPerronis]

i have no clue what that is

[Gongshow]

what the hell is that?

[Ditsz]

IMO it is spoof mail! I get the same thing here at work. Virus's have evolved and you can no longer see who the sender is. Chances are (The Sobig worm does not affect Linux OS...) that someone who has your email address is infected and it is just spoof mail....

See below:

Due to the number of submissions received from customers, Symantec Security Response has upgraded this threat to a Category 4 from a Category 3 threat as of August 21, 2003.

W32.Sobig.F@mm is a mass-mailing, network-aware worm that sends itself to all the email addresses it finds in the files that have the following extensions:


.dbx
.eml
.hlp
.htm
.html
.mht
.wab
.txt

The worm uses its own SMTP engine to propagate and attempts to create a copy of itself on accessible network shares, but fails due to bugs in the code.


Email routine details
The email message has the following characteristics:

From: Spoofed address (which means that the sender in the "From" field is most likely not the real sender). The worm may also use the address, [email protected], as the sender.

NOTES:
The spoofed addresses and the Send To addresses are both taken from the files found on the computer. Also, the worm may use the settings of the infected computer's settings to check for an SMTP server to contact.
The choice of the internet.com domain appears to be arbitrary and does not have any connection to the actual domain or its parent company.

Subject:
Re: Details
Re: Approved
Re: Re: My details
Re: Thank you!
Re: That movie
Re: Wicked screensaver
Re: Your application
Thank you!
Your details

Body:
See the attached file for details
Please see the attached file for details.

Attachment:
your_document.pif
document_all.pif
thank_you.pif
your_details.pif
details.pif
document_9446.pif
application.pif
wicked_scr.scr
movie0045.pif


NOTES:
The worm de-activates on September 10, 2003. The last day on which the worm will spread is September 9, 2003.
The aforementioned de-activation date applies only to the mass-mailing, network propagation, and email address collection routines. This means that a W32.Sobig.F@mm-infected computer will still attempt to download the updates from the respective list of master servers during the associated trigger period, even after the infection de-activation date. Previous variants of Sobig exhibited similar behavior.
Outbound udp traffic was observed on August 22nd, coming from systems infected with both Sobig.E and Sobig.F. However, the target IP addresses were either not responding, taken offline, or contained non-executable content; that is, a link to an adult site.
W32.Sobig.F@mm uses a technique known as "email spoofing," by which the worm randomly selects an address it finds on an infected computer. For more information on email spoofing, see the "Technical Details" section below.

Symantec Security Response has developed a removal tool to clean the infections of W32.Sobig.F@mm.

Also Known As: Sobig.F [F-Secure], W32/Sobig.f@MM [McAfee], WORM SOBIG.F [Trend], W32/Sobig-F [Sophos], Win32.Sobig.F [CA], I-Worm.Sobig.f [KAV]

Type: Worm
Infection Length: about 72,000 bytes



Systems Affected: Windows 2000, Windows 95, Windows 98, Windows Me, Windows NT, Windows XP
Systems Not Affected: Linux, Macintosh, OS/2, UNIX, Windows 3.x

Hope this helps....
;0)

[Mudge]

Alot of those right now send the mail to you discuised as if you sent it, and they send the attachment sometimes in zip like your_details.zip hoping that you will activate the attachment.

Just delete them, you ARE running antivirus right?

[LiLPerronis]

from:sky antivirus subject:E-mail Antivirus scan results