Eskimo North


[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Forgery: "Billing Notice From eskimo.com 's Accounting Dpt" (fwd)





Another forgery to be wary of, most likely the same potential-virus
attachment as the previously seen "Virus Alert" email reported here.

Because these emails seem to originate from random email addresses, we
thought it would be an good time to remind you to be careful of any email
that asks you to download something, particularly if it claims to be an
offical announcement.

Legitimate reminders of expiring accounts would ask you to CALL or MAIL us,
not burden the email with attachments, and certainly with longer warnings
than one day.  And of course, they would actually be FROM us, not an
outside address like these.

The file attached to this one (stripped out in this email), "page.hta" is
not yet listed in searches on Symantec/Norton search utility, so I'm not
aware of it being a reported virus yet, but *.hta files are known scripting
vulnerabilities in Internet Explorer when scripting is enabled.

~ Eric


---------- Forwarded message ----------
From Carlinekvprcgcucadw@blackeye.com  Wed Jan 21 19:03:24 2004
Received: from cgodl (h24-82-242-105.va.shawcable.net [24.82.242.105])
	by mx2.eskimo.com (8.9.1a/8.8.8) with SMTP id TAA17875
	for <[...]@eskimo.com>; Wed, 21 Jan 2004 19:00:53 -0800 (PST)
From: Nickie <Carlinekvprcgcucadw@blackeye.com>
Reply-To: <Carlinekvprcgcucadw@blackeye.com>
To: <[...]@eskimo.com>
Subject: Billing Notice From eskimo.com 's Accounting Dpt
Date: Wed, 21 Jan 2004 19:57:57 -0500
Message-Id: <damullajyxfy@blackeye.com>
Mime-Version: 1.0
Content-Type: multipart/mixed; boundary="bqnmppryx_1074733130"

--bqnmppryx_1074733130
Content-Type: application/hta; name="page.hta"
Content-Transfer-Encoding: base64

[...]

--bqnmppryx_1074733130
Content-Type: text/html
Content-Transfer-Encoding: quoted-printable

<HTML><P ALIGN=3DCENTER><FONT  SIZE=3D3 PTSIZE=3D12 FAMILY=3D"SANSSERIF" FA=
CE=3D"Arial" LANG=3D"0"><B>***&nbsp; eskimo.com 's accounting dpt notice **=
*</FONT><FONT  COLOR=3D"#000000" BACK=3D"#ffffff" style=3D"BACKGROUND-COLOR=
: #ffffff" SIZE=3D6 PTSIZE=3D24 FAMILY=3D"SANSSERIF" FACE=3D"Arial" LANG=3D=
"0"></B><BR>
</FONT><FONT  COLOR=3D"#000000" BACK=3D"#ffffff" style=3D"BACKGROUND-COLOR:=
 #ffffff" SIZE=3D5 PTSIZE=3D18 FAMILY=3D"SANSSERIF" FACE=3D"Arial" LANG=3D"=
0">Internet Billing Notice<BR>
Please press "open" and read the attached Billing Notice.<BR>
<BR>
Note if you do not read this withing 24 hours we at eskimo.com regret we wi=
ll have to terminate internet service.</P></FONT></HTML>


--bqnmppryx_1074733130--