My apologies to all for bothering anyone, but I've been getting wierd, vulgar gibberish spam messages for months, and forwarding each one to my ISP tech dept to block, but they keep coming. I finally used MailWasher to check full header plus the typically broken mssg on what seems to be another one today, and it is as follows (I replaced my actual email address prefix by [DELETED] for privacy);
Return-path: <akstcaustraliamnsdgs@australia.edu>
Envelope-to: DELETED@ruraltel.net
Received: from mail3.ruraltel.net ([24.225.0.36])
by atmail with smtp (Exim 4.60)
(envelope-from <akstcaustraliamnsdgs@australia.edu>)
id 1GfZ4S-0007tV-G1
for DELETED@ruraltel.net; Thu, 02 Nov 2006 03:41:12 -0600
X-Spam-Score: 2.4
X-Spam-Flag: NO
X-Spam-Level: **
X-Spam-Status: No, hits=2.4 required=4.0
X-Spam-Processed-By: spamd3.ruraltel.net
X-Spam-Report: 2.4 points, 4.0 required
* 2.4 DATE_IN_FUTURE_96_XX Date: is 96 hours or more after Received: date
* 0.0 BAYES_50 BODY: Bayesian spam probability is 40 to 60%
* [score: 0.4555]
Received: from amazonas-4642.adsl.datanet.hu (HELO Krissz) (91.120.114.70)
by mail3.ruraltel.net with SMTP; 2 Nov 2006 09:41:11 -0000
Received-SPF: none (mail3.ruraltel.net: domain at australia.edu does not designate permitted sender hosts)
Received: from 216.15.179.130 (HELO gold.internet-media.net)
by ruraltel.net with esmtp (S113MYCUH3A BIN2O)
id 9NBUHG-216973-B2
for svferg@ruraltel.net; Thu, 2 Dec 2006 09:41:12 -0060
Date: Thu, 2 Dec 2006 09:41:12 -0060
From: "Rachel Newell" <akstcaustraliamnsdgs@australia.edu>
X-Mailer: The Bat! (v2.00.9) Educational
X-Priority: 3 (Normal)
Message-ID: <481698102.91985773155631@thebat.net>
To: svferg@ruraltel.net
Subject: nose-leafed mosaic binding
MIME-Version: 1.0
Content-Type: text/plain;
charset=iso-8859-1
Content-Transfer-Encoding: quoted-printable
X-Spam: Not detected
elizabeth almost stared at her. "can this be mr. darcy?" thought=20=
she."that is to say, you had given your permission. i guessed as much."=20=
and though he exclaimed at
END QUOTE.
Please notice it contains a line that starts;
X-Mailer: The Bat!
which is what brought me here. I've heard of viruses that can hijack innocent users' machines to do stuff like this, even substituting false headers for real ones somehow. I'm seeking responses from anyone who thinks they can help figure out what is going on here. Perhaps someone just needs to be informed their pc has been hijacked? If I get any more, I will see if they also contain a thebat line.
My personal email contact for this forum is through SNEAKEMAIL, which is a legitimate paid anti-spam virtual email service, but the spammer seems to be targeting my actual home email address.
Regards,
'thebatnut'
Return-path: <akstcaustraliamnsdgs@australia.edu>
Envelope-to: DELETED@ruraltel.net
Received: from mail3.ruraltel.net ([24.225.0.36])
by atmail with smtp (Exim 4.60)
(envelope-from <akstcaustraliamnsdgs@australia.edu>)
id 1GfZ4S-0007tV-G1
for DELETED@ruraltel.net; Thu, 02 Nov 2006 03:41:12 -0600
X-Spam-Score: 2.4
X-Spam-Flag: NO
X-Spam-Level: **
X-Spam-Status: No, hits=2.4 required=4.0
X-Spam-Processed-By: spamd3.ruraltel.net
X-Spam-Report: 2.4 points, 4.0 required
* 2.4 DATE_IN_FUTURE_96_XX Date: is 96 hours or more after Received: date
* 0.0 BAYES_50 BODY: Bayesian spam probability is 40 to 60%
* [score: 0.4555]
Received: from amazonas-4642.adsl.datanet.hu (HELO Krissz) (91.120.114.70)
by mail3.ruraltel.net with SMTP; 2 Nov 2006 09:41:11 -0000
Received-SPF: none (mail3.ruraltel.net: domain at australia.edu does not designate permitted sender hosts)
Received: from 216.15.179.130 (HELO gold.internet-media.net)
by ruraltel.net with esmtp (S113MYCUH3A BIN2O)
id 9NBUHG-216973-B2
for svferg@ruraltel.net; Thu, 2 Dec 2006 09:41:12 -0060
Date: Thu, 2 Dec 2006 09:41:12 -0060
From: "Rachel Newell" <akstcaustraliamnsdgs@australia.edu>
X-Mailer: The Bat! (v2.00.9) Educational
X-Priority: 3 (Normal)
Message-ID: <481698102.91985773155631@thebat.net>
To: svferg@ruraltel.net
Subject: nose-leafed mosaic binding
MIME-Version: 1.0
Content-Type: text/plain;
charset=iso-8859-1
Content-Transfer-Encoding: quoted-printable
X-Spam: Not detected
elizabeth almost stared at her. "can this be mr. darcy?" thought=20=
she."that is to say, you had given your permission. i guessed as much."=20=
and though he exclaimed at
END QUOTE.
Please notice it contains a line that starts;
X-Mailer: The Bat!
which is what brought me here. I've heard of viruses that can hijack innocent users' machines to do stuff like this, even substituting false headers for real ones somehow. I'm seeking responses from anyone who thinks they can help figure out what is going on here. Perhaps someone just needs to be informed their pc has been hijacked? If I get any more, I will see if they also contain a thebat line.
My personal email contact for this forum is through SNEAKEMAIL, which is a legitimate paid anti-spam virtual email service, but the spammer seems to be targeting my actual home email address.
Regards,
'thebatnut'