VIRUS? I got this in the mail, what do you think??

[911paramedic]

I got this in the mail today, I did not know who it was from so I checked the source to read it (like I always do)

Is this a virus of some sort, looks compiled to me...


Return-Path: <Thalia8375w25@sensuell.com>
Received: from p-route-4.lvcm.net (p-route-4.lvcm.net [24.234.0.75])
by mt1.lvcm.net (Mirapoint Messaging Server MOS 2.9.3.2)
with ESMTP id BMO92208;
Mon, 27 May 2002 12:37:25 -0700 (PDT)
From: <Thalia8375w25@sensuell.com>
Received: from sensuell.com (adsl-64-163-53-228.dsl.lsan03.pacbell.net [64.163.53.228])
by p-route-4.lvcm.net (Postfix) with SMTP
id CAA872FA36; Mon, 27 May 2002 12:36:33 -0700 (PDT)
Reply-To: <Thalia8375w25@sensuell.com>
Message-ID: <032b14a43d2c$1243c7e7$8ac45be6@dwofyj>
To: <XXXXXXX@lvcablemodem.com>, <XXXXXXX@lvcablemodem.com>,
<XXXXXXXX@lvcablemodem.com>, <XXXXXXXX@lvcablemodem.com>
Subject: Hey friend!
Date: Mon, 27 May 2002 10:37:04 +0800
MiME-Version: 1.0
Content-Type: multipart/mixed;
boundary="----=_NextPart_000_00C2_05D13A8A.C6624E86"
X-Priority: 3 (Normal)
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2600.0000
Importance: Normal

------=_NextPart_000_00C2_05D13A8A.C6624E86
Content-Type: text/html; charset="iso-8859-1"
Content-Transfer-Encoding: base64


PCEtLSBzYXZlZCBmcm9tIHVybD0oMDAyMilodHRwOi8vaW50ZXJuZXQuZS1t
YWlsIC0tPg0KPGh0bWw+DQo8Ym9keT4NCjxibG9ja3F1b3RlPg0KICA8cCBh
bGlnbj0ibGVmdCI+PGZvbnQgc2l6ZT0iNiI+PGZvbnQgY29sb3I9IiMwMDAw
RkYiPlN0b2NrIE1hcmtldCBCbHVlcyBnb3QgeW91IGRvd24/PC9mb250PiZu
YnNwOzwvZm9udD48YnI+DQogIDxicj4NCiAgPGZvbnQgc2l6ZT0iNSIgY29s
b3I9IiNGRjAwMDAiPkxvb2tpbmcgZm9yIGEgdmlhYmxlIGFuZCBsZWdpdGlt
YXRlIGFsdGVybmF0aXZlPyZuYnNwOzwvZm9udD48Zm9udCBzaXplPSI0Ij48
YnI+DQogIDwvZm9udD48YnI+DQogIDxmb250IHNpemU9IjQiPldoYXQgZG8g
eW91IHRoaW5rIHdpbGwgaGFwcGVuIHRvIHVubGVhZGVkIGdhc29saW5lIHBy
aWNlcyBiZXR3ZWVuIG5vdyBhbmQgdGhpcyBzdW1tZXI/Jm5ic3A7PGJyPg0K
ICA8YnI+DQogIERpZCB5b3Uga25vdyB0aGF0IHRoZXJlIGhhc26SdCBiZWVu
IGEgbmV3IHJlZmluZXJ5IGJ1aWx0IGluIHRoZSBVbml0ZWQgU3RhdGVzIGlu
IG92ZXIgMjAgeWVhcnM/Jm5ic3A7PGJyPg0KICA8YnI+DQogIERvIHlvdSBr
bm93IHRoYXQgeW91IGNhbiB0cmFkZSBvcHRpb25zIG9uIHVubGVhZGVkIGdh
c29saW5lIGNvbnRyYWN0cyBvbiB0aGUgTmV3IFlvcmsgTWVyY2FudGlsZSBF
eGNoYW5nZSwNCiAgYSBnb3Zlcm5tZW50IHJlZ3VsYXRlZCBleGNoYW5nZT8g
IFdlIGFyZSB0aGUgcHJvZmVzc2lvbmFscyB3aG8gc3BlY2lhbGl6ZSBpbiB0
aGVzZSBtYXJrZXRzIGFuZCB0cmFkZSB0aGVtIG9uIGEgcmVndWxhciBiYXNp
cy4mbmJzcDs8YnI+DQogIDxicj4NCiAgUmVjZWl2ZSB5b3VyIGZyZWUgcmVw
b3J0LCBpbmNsdWRpbmcgdGhlIGJvb2tsZXQgIjI2IFBsYWluIExhbmd1YWdl
IEFuc3dlcnMgb24gT3B0aW9ucyBUcmFkaW5nIi4mbmJzcDs8YnI+DQogIDxi
cj4NCiAgR2V0IHRoZSBjaGFydHMsIGdyYXBocyBhbmQgdGhlIHNwZWNpYWwg
cmVwb3J0IG9uIFVubGVhZGVkIEdhc29saW5lIC0gU3VtbWVyIDIwMDIuJm5i
c3A7PGJyPg0KICBGdXR1cmVzIGFuZCBvcHRpb25zIHRyYWRpbmcgaW52b2x2
ZSBzdWJzdGFudGlhbCByaXNrIG9mIGxvc3MgYW5kIGlzIG5vdCBzdWl0YWJs
ZSBmb3IgZXZlcnlvbmUuJm5ic3A7PGJyPg0KICA8YnI+DQogIExlYXJuIGhv
dyBvcHRpb25zIHRyYWRpbmcgY2FuIHBvc2l0aW9uIHlvdSBpbiB0aGlzIGFt
YXppbmcgbWFya2V0LiZuYnNwOzxicj4NCiAgPGJyPg0KICA8YSBocmVmPSJo
dHRwOi8vODEuOS4lMzguNCUyRkdhJTczJTZGbGklNkVlJTUyZSU3MCU2RnJ0
cyI+Q2xpY2sgaGVyZTwvYT4gYW5kIHlvdSB3aWxsIHJlY2VpdmUgdGhlIFVu
bGVhZGVkIEdhc29saW5lIHNwZWNpYWwgcmVwb3J0LiZuYnNwOzxicj4NCiAg
JDUsMDAwIHdpbGwgcHVyY2hhc2UgZml2ZSBVbmxlYWRlZCBHYXNvbGluZSBv
cHRpb24gY29udHJhY3RzLiZuYnNwOzxicj4NCiAgTWluaW11bSAkNSwwMDAg
aW52ZXN0bWVudC4mbmJzcDs8YnI+DQogIFRha2UgYWR2YW50YWdlIG9mIHdo
YXQgd2UgYmVsaWV2ZSBpcyBhbiBvdXRzdGFuZGluZyBpbnZlc3RtZW50IG9w
cG9ydHVuaXR5ISZuYnNwOzxicj4NCiAgPGJyPg0KICA8YSBocmVmPSJodHRw
Oi8vODEuOS44LiUzNC9HYXNvJTZDaW4lNjUlNTIlNjVwJTZGciU3NCU3MyUy
RiI+Q2xpY2sgSGVyZSBOT1chPC9hPiZuYnNwOzxicj4NCiAgPGJyPg0KICA8
L2ZvbnQ+PGZvbnQgc2l6ZT0iMyI+PGEgaHJlZj0iaHR0cDovLyUzODElMkUl
MzkuOCUyRSUzNCUyRkwlNjlzJTc0JTRGJTcwJTc0JTRGdSU3NC8iPkNsaWNr
IEhlcmUgVG8gYmUgdGFrZW4gb2ZmIHRoZSBsaXN0IQ0KICA8L2E+PC9mb250
PjwvcD4NCjwvYmxvY2txdW90ZT4NCg0KPC9ib2R5Pg0KDQo8L2h0bWw+DQoN
Cg0KMTgzNnljVGc0LTgyMld1VkE5MDc4cVBLTDctNzExcnJJZTQ2MDFRbUxy
Ni02ODFEWWw0Ng==
------=_NextPart_000_00C2_05D13A8A.C6624E86--

 

[Wallydraigle]

If it's not from someone you know, then it's probably either a virus or spam. You don't need either. Just ditch it. If it's important they'll write back.

 

[Zorro]

You might want to edit out the other to email addy. Unless you have there permission to use them.

 

[911paramedic]

Originally posted by: Zorro
You might want to edit out the other to email addy. Unless you have there permission to use them.

Good plan, but I am not editing the senders, damn spammers.

 

[911paramedic]

Originally posted by: lirion
If it's not from someone you know, then it's probably either a virus or spam. You don't need either. Just ditch it. If it's important they'll write back.

I do delete them as soon as I see them for the most part. If I have any doubt I will look at the source code to read the mail without actually opening it. Worked well for me so far, I don't think you can "activate" a virus by viewing the source, so that has been my trick so far.

 

[nukefarmer]

it's a base64 encoded spam mail, probably to avoid spam filters, that tries to sell you Unleaded Gasoline stock option contracts.