Return-Path: Received: from post.thorcom.com (post.thorcom.com [195.171.43.25]) by mtain-ma01.r1000.mx.aol.com (Internet Inbound) with ESMTP id 75A013800009E; Tue, 29 May 2012 06:54:40 -0400 (EDT) Received: from majordom by post.thorcom.com with local (Exim 4.14) id 1SZK3Q-0001mn-9q for rs_out_1@blacksheep.org; Tue, 29 May 2012 11:53:32 +0100 Received: from [195.171.43.32] (helo=relay1.thorcom.net) by post.thorcom.com with esmtp (Exim 4.14) id 1SZK3P-0001me-NV for rsgb_lf_group@blacksheep.org; Tue, 29 May 2012 11:53:31 +0100 Received: from nm25-vm0.bullet.mail.ird.yahoo.com ([212.82.109.201]) by relay1.thorcom.net with smtp (Exim 4.77) (envelope-from ) id 1SZK3N-0000Xc-2l for rsgb_lf_group@blacksheep.org; Tue, 29 May 2012 11:53:30 +0100 Received: from [77.238.189.51] by nm25.bullet.mail.ird.yahoo.com with NNFMP; 29 May 2012 10:53:28 -0000 Received: from [212.82.108.227] by tm4.bullet.mail.ird.yahoo.com with NNFMP; 29 May 2012 10:53:28 -0000 Received: from [127.0.0.1] by omp1004.bt.mail.ird.yahoo.com with NNFMP; 29 May 2012 10:53:28 -0000 X-Yahoo-Newman-Id: 109002.71062.bm@omp1004.bt.mail.ird.yahoo.com Received: (qmail 98981 invoked from network); 29 May 2012 10:53:27 -0000 DomainKey-Signature: a=rsa-sha1; q=dns; c=nofws; s=s1024; d=btinternet.com; h=DKIM-Signature:X-Yahoo-Newman-Property:X-YMail-OSG:X-Yahoo-SMTP:Received:Message-ID:From:To:References:Subject:Date:MIME-Version:Content-Type:Content-Transfer-Encoding:X-Priority:X-MSMail-Priority:X-Mailer:X-MimeOLE:X-Antivirus:X-Antivirus-Status; b=jR+AwqOUT3b8+BREAQ/MwE5dhGlD40Eis/88UZK8xrWr3GnWZONEb++DhFF6k0NITk9/ZAIPeE3XDza62S0ysd34AyFLXl8QqYCP0ewZ4sRHF97GAtc0kbwG9tOHL5ehIra8kcNzIjJOwsKN0+YpWDvsOR81WFtbfm7tb1wafy8= ; DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=btinternet.com; s=s1024; t=1338288807; bh=cYgYF//iWQVIKC2YC+XtxX29E1P6wN5Kdu7t9lLAa3k=; h=X-Yahoo-Newman-Property:X-YMail-OSG:X-Yahoo-SMTP:Received:Message-ID:From:To:References:Subject:Date:MIME-Version:Content-Type:Content-Transfer-Encoding:X-Priority:X-MSMail-Priority:X-Mailer:X-MimeOLE:X-Antivirus:X-Antivirus-Status; b=M9T0oO3hei22Jy8AYAytIaxYNcBKxNi7GmGtq4l8rCCMWbY3KQOr8zY0M4erLyGnLfywfsNtQzjKD9Hd+C9uINODH3KfiwcsfhHBskOU8o2EC8YUXa+7UJUm6qFtVlFQ0U6mXHppTGNDBT51W+mgVqZvPse+7XNSO723YhsWoUs= X-Yahoo-Newman-Property: ymail-3 X-YMail-OSG: qqQeprYVM1kiMKk2luF.dSMCryFzl9WM2wDdTA50n_C1iz1 NxgUG7UOZQsqDKgkQp390jf2PpDd4wj.PBu6OxHBlyD1qKCvfCEeXPL943nt ejo3c330kXH4xzoAXkVDNLkROjOlRZhJbkNEtvFnIu_1WkxPuFPn3._Nze2d K4TTgGPeLH4KpTzzNN6fLkPVA9KIRJPbTSmOBmQaXp4TDysCfEzj_wvTFRZF Ien8SiolJHYdbE_O90SpwrTfJgGHLi6x2b4FFwHtJdx.1OOqDkKrpaAAqD3I APERogid33xKxKdntbItutyYavplvAd5RneQNnSDe2zyQq1M.uACZXytshrs 95p4KvPqLh5WcT11V4nVO.jItBl5TZLLWozMYGuRnf.c3cvZbIF4LQ4iAUQY k5mkSMVA1GpyZObefFf0W0g-- X-Yahoo-SMTP: fpz.2VeswBBs59bVshRPmMN51lcO2lgFRIvE4XTqE8dRwOxd70E- Received: from lark (alan.melia@109.155.63.143 with login) by smtp820.mail.ukl.yahoo.com with SMTP; 29 May 2012 03:53:27 -0700 PDT Message-ID: <00ac01cd55e5$93c1dd40$4001a8c0@lark> From: "Alan Melia" To: References: <1338274895.54377.YahooMailNeo@web112313.mail.gq1.yahoo.com> <01203470269C41BBB8065476B5656FFC@Extensa> <004601cd55de$0cecab30$4001a8c0@lark> <220E392EC0D542DB85B98EAE17236BF1@Extensa> Date: Fri, 29 Jun 2012 11:54:28 +0100 MIME-Version: 1.0 X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2800.2001 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.2001 X-Antivirus: avast! (VPS 120529-0, 29/05/2012), Outbound message X-Antivirus-Status: Clean X-Spam-Score: 1.4 (+) X-Spam-Report: Spam detection software, running on the system "relay1.thorcom.net", has identified this incoming email as possible spam. The original message has been attached to this so you can view it (if it isn't spam) or label similar future email. If you have any questions, see the administrator of that system for details. Content preview: Hi Peter there is an interesting analysis in the header I got Rightclick Properties>detail>messagesource It doesnt his high on a spam count but there are some interesting comments, after the spamcount check. Alan [...] Content analysis details: (1.4 points, 5.0 required) pts rule name description ---- ---------------------- -------------------------------------------------- -0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no trust [212.82.109.201 listed in list.dnswl.org] 1.4 DATE_IN_FUTURE_96_Q Date: is 4 days to 4 months after Received: date 0.0 UNPARSEABLE_RELAY Informational: message has unparseable relay lines 0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid X-Scan-Signature: d7907c3bf895ca41e0bedc3fa074f0d4 Subject: LF: Re: Re: Re: Re: (was blank, but take care. Seems to be virus) Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: 7bit X-Spam-Checker-Version: SpamAssassin 2.63 (2004-01-11) on post.thorcom.com X-Spam-Level: ** X-Spam-Status: No, hits=2.4 required=5.0 tests=DATE_IN_FUTURE_96_XX autolearn=no version=2.63 X-SA-Exim-Scanned: Yes Sender: owner-rsgb_lf_group@blacksheep.org Precedence: bulk Reply-To: rsgb_lf_group@blacksheep.org X-Listname: rsgb_lf_group X-SA-Exim-Rcpt-To: rs_out_1@blacksheep.org X-SA-Exim-Scanned: No; SAEximRunCond expanded to false x-aol-global-disposition: G X-AOL-SCOLL-SCORE: 0:2:492989216:93952408 X-AOL-SCOLL-URL_COUNT: 0 X-AOL-SCOLL-AUTHENTICATION: mail_rly_antispam_dkim-m011.2 ; domain : btinternet.com DKIM : fail x-aol-sid: 3039ac1d60094fc4aaee5c4c X-AOL-IP: 195.171.43.25 X-AOL-SPF: domain : blacksheep.org SPF : temperror Hi Peter there is an interesting analysis in the header I got Rightclick Properties>detail>messagesource It doesnt his high on a spam count but there are some interesting comments, after the spamcount check. Alan ----- Original Message ----- From: "PA1SDB, Peter" To: Sent: Tuesday, May 29, 2012 11:27 AM Subject: LF: Re: Re: Re: (was blank, but take care. Seems to be virus) > Hello Alan, > > >Muli addressing, no subject line, and a OT clickable link are all quite suspicious. > > Hi Hi. Yes, I know, but I trust my visus scanner (AVIRA (for free :-) ) and alway to curious what people send in a web link.... > So I did hit that link. No dammage here. > > Just a virus message by Avira. > [Delete ? Y / N] > YES, please ASAP > > :-) > > 73,s Peter - PA1SDB > > > > > > ----- Original Message ----- > From: "Alan Melia" > To: > Sent: Friday, June 29, 2012 9:58 AM > Subject: LF: Re: Re: (was blank, but take care. Seems to be virus) > > > > Thanks Peter I have informed Tony, that I think his address book has been > > compromised. Muli addressing, no subject line, and a OT clickable link are > > all quite suspicious. Strong that it should be posted to blacksheep and not > > the Yaho group that tony just joined.!! > > > > Alan G3NYK > > > > ----- Original Message ----- > > From: "PA1SDB, Peter" > > To: > > Sent: Tuesday, May 29, 2012 8:32 AM > > Subject: LF: Re: (was blank, but take care. Seems to be virus) > > > > > >> There is a virus in that link below say's my virus scanner !!! > >> 73's, Peter - PA1SDB > >> > > > > >