[boost] Re: Got a boost-request email with MyDoom in it...

From: Dan W. (danw_at_[hidden])
Date: 2004-02-11 22:40:55

Here's a Sam Spade analysis of the header:

-------------------------------------------
02/11/04 22:30:45 Spade Log
02/11/04 22:31:26 Input
The Received: headers are the important ones to read
My comments are just hints, and should be considered only
an opinion. I may have guessed wrong, or things may have
changed since I was written

Return-Path: <boost-bounces_at_[hidden]>
Delivered-To:
     raytron-controls.com-danw_at_[hidden]
Received: (qmail 3143 invoked by uid 417); 12 Feb 2004
     01:56:58 -0000
   This received header was added by your mailserver
   Just a qmail status line

Received: from unknown (HELO heart-of-gold.osl.iu.edu)
     (129.79.245.244)   by 192.168.0.39 with SMTP; 12 Feb 2004
     01:56:58 -0000
   192.168.0.39 received this from someone claiming
   to be unknown
   (192.168.0.39 doesn't record the senders IP
    address in any way I recognise, so it's impossible to be
    sure. All received headers after this one should be
    treated with suspicion)

Received: from heart-of-gold.osl.iu.edu
     (localhost.localdomain [127.0.0.1])         by
     heart-of-gold.osl.iu.edu (8.11.6/8.11.6) with ESMTP id
     i1C0b0529863;         Wed, 11 Feb 2004 19:37:00 -0500
   heart-of-gold.osl.iu.edu received this from someone claiming
   to be heart-of-gold.osl.iu.edu
   but really from 127.0.0.1(No rDNS)

   All headers below may be forged

Date: Wed, 11 Feb 2004 19:37:00 -0500
Message-Id:
     <200402120037.i1C0b0529863_at_[hidden]>
From: boost-request_at_[hidden]
Subject: Boost Digest, Vol 639, Issue 6
To: boost_at_[hidden]
X-BeenThere: boost_at_[hidden]
X-Mailman-Version: 2.1.4
Precedence: list
List-Id: Boost mailing list <boost.lists.boost.org>
   Hmmm list-id: isn't a header I recognise
List-Help:
     <mailto:boost-request_at_[hidden]?subject=help>
   Hmmm list-help: isn't a header I recognise
List-Post: <mailto:boost_at_[hidden]>
   Hmmm list-post: isn't a header I recognise
List-Subscribe:
     <http://lists.boost.org/mailman/listinfo.cgi/boost>,
      <mailto:boost-request_at_[hidden]?subject=subscribe>
   Hmmm list-subscribe: isn't a header I recognise
List-Archive: <http://lists.boost.org/MailArchives/boost>
   Hmmm list-archive: isn't a header I recognise
List-Unsubscribe:
     <http://lists.boost.org/mailman/listinfo.cgi/boost>,
      <mailto:boost-request_at_[hidden]?subject=unsubscribe>
   Hmmm list-unsubscribe: isn't a header I recognise
Sender: boost-bounces_at_[hidden]
Errors-To: boost-bounces_at_[hidden]
-------------------------------------------

Cheers!