<div bgcolor="#ffffff" text="#000000">
Thanks man! You're a legend.<br>
I'll look into what I have to see if it really did come from me or if I've been spoofed.<br><br>Cheers<br>Chovynz<br><br><br>
On 20/04/2010 7:43 a.m., J. Alves wrote:
<blockquote type="cite">
<pre>Sorry I can't help you with the virus situation, since I've been using
Linux for 10 years and have forgotten how the incantations go for
these Windows problems... Until (if...) this OS gets more popular, I
hope to be in blissful forgetfulness of such antics. :-)
Looking at the full headers of the email tells you, hopefully, where
the email came from -- if it wasn't spoofed in any way. Here's what I
could get from them (an email that arrived on April 11 and I still had
in the trash; I deleted permanently the one that arrived today or
yesterday, so I can't compare):
============================================
Delivered-To: <a href="mailto:alvesjmp@gmail.com" target="_blank">alvesjmp@gmail.com</a>
Received: by 10.204.99.82 with SMTP id t18cs48388bkn;
Sun, 11 Apr 2010 15:17:03 -0700 (PDT)
Received: by 10.141.91.3 with SMTP id t3mr2215769rvl.191.1271024221214;
Sun, 11 Apr 2010 15:17:01 -0700 (PDT)
Return-Path: <a href="mailto:clipart-bounces@lists.freedesktop.org" target="_blank"><clipart-bounces@lists.freedesktop.org></a>
Received: from <a href="http://gabe.freedesktop.org" target="_blank">gabe.freedesktop.org</a> (<a href="http://gabe.freedesktop.org" target="_blank">gabe.freedesktop.org</a> [131.252.210.177])
by <a href="http://mx.google.com" target="_blank">mx.google.com</a> with ESMTP id 10si10541498pzk.24.2010.04.11.15.17.00;
Sun, 11 Apr 2010 15:17:01 -0700 (PDT)
Received-SPF: pass (<a href="http://google.com" target="_blank">google.com</a>: domain of
<a href="mailto:clipart-bounces@lists.freedesktop.org" target="_blank">clipart-bounces@lists.freedesktop.org</a> designates 131.252.210.177 as
permitted sender) client-ip=131.252.210.177;
Authentication-Results: <a href="http://mx.google.com" target="_blank">mx.google.com</a>; spf=pass (<a href="http://google.com" target="_blank">google.com</a>: domain of
<a href="mailto:clipart-bounces@lists.freedesktop.org" target="_blank">clipart-bounces@lists.freedesktop.org</a> designates 131.252.210.177 as
permitted sender) <a href="mailto:smtp.mail=clipart-bounces@lists.freedesktop.org" target="_blank">smtp.mail=clipart-bounces@lists.freedesktop.org</a>
Received: from <a href="http://gabe.freedesktop.org" target="_blank">gabe.freedesktop.org</a> (localhost [127.0.0.1])
by <a href="http://gabe.freedesktop.org" target="_blank">gabe.freedesktop.org</a> (Postfix) with ESMTP id C4F1C9EB36;
Sun, 11 Apr 2010 15:16:59 -0700 (PDT)
X-Original-To: <a href="mailto:clipart@lists.freedesktop.org" target="_blank">clipart@lists.freedesktop.org</a>
Delivered-To: <a href="mailto:clipart@lists.freedesktop.org" target="_blank">clipart@lists.freedesktop.org</a>
X-Greylist: delayed 306 seconds by postgrey-1.31 at gabe;
Sun, 11 Apr 2010 15:16:57 PDT
Received: from localhost (unknown [113.169.33.57])
by <a href="http://gabe.freedesktop.org" target="_blank">gabe.freedesktop.org</a> (Postfix) with SMTP id 4BDC09EB22
for <a href="mailto:clipart@lists.freedesktop.org" target="_blank"><clipart@lists.freedesktop.org></a>;
Sun, 11 Apr 2010 15:16:56 -0700 (PDT)
From: � Pfizer Inc � 1965-2010 <a href="mailto:clipart@lists.freedesktop.org" target="_blank"><clipart@lists.freedesktop.org></a>
To: <a href="mailto:clipart@lists.freedesktop.org" target="_blank">clipart@lists.freedesktop.org</a>
MIME-Version: 1.0
Message-Id: <a href="mailto:20100411221657.4BDC09EB22@gabe.freedesktop.org" target="_blank"><20100411221657.4BDC09EB22@gabe.freedesktop.org></a>
Date: Sun, 11 Apr 2010 15:16:56 -0700 (PDT)
Subject: [Clipart] Dear <a href="mailto:clipart@lists.freedesktop.org" target="_blank">clipart@lists.freedesktop.org</a> April 66% 0FF
============================================
The important lines here are the "Received:" ones, and the first one
should be the originator, if everything is correct. In this case, it
would be IP number 113.169.33.57, which according to whois locates to
Vietnam:
inetnum: 113.160.0.0 - 113.191.255.255
netname: VNPT-VNNIC-VN
descr: VietNam Post and Telecom Corporation
descr: 23 Phan Chau Trinh, Hoan Kiem Dist, Ha Noi
country: VN
...
So, the email seems to have done the following path:
113.169.33.57 -> <a href="http://gabe.freedesktop.org" target="_blank">gabe.freedesktop.org</a> (131.252.210.177, which GMail
approves of according to the SPF thing in the headers) ->
<a href="http://mx.google.com" target="_blank">mx.google.com</a> (internal Google server, 10.204.99.82) -> my eyes
I guess. :-)
The email body itself is HTML, and asks for images (which I don't
allow loading automatically, ever).
It also points to a page with a Russian address:
<a href="http://www.edgehole.ru" target="_blank">http://www.edgehole.ru</a> (I wouldn't go there if I was you) :-)
Again, these things in the headers can be faked, so don't take this as
100% certain. But at least the part after the <a href="http://freedesktop.org" target="_blank">freedesktop.org</a> seems to
be good, because of the SPF pass.
Any other ideas?
Cheers
J
On Mon, Apr 19, 2010 at 1:03 PM, chovynz <a href="mailto:chovynz@gmail.com" target="_blank"><chovynz@gmail.com></a> wrote:
</pre>
<blockquote type="cite">
<pre>Jon
Is there anyway that the list owners could find those emails and see where
they are coming from?
Are you able to remove that subscriber if it is found to be some company not
legitimate?
I recommend looking for any Pfizer subscribers.
Cheers
Chovynz
_______________________________________________
clipart mailing list
<a href="mailto:clipart@lists.freedesktop.org" target="_blank">clipart@lists.freedesktop.org</a>
<a href="http://lists.freedesktop.org/mailman/listinfo/clipart" target="_blank">http://lists.freedesktop.org/mailman/listinfo/clipart</a>
</pre>
</blockquote>
<pre>
</pre>
</blockquote>
<br>
</div>