[ANSTHRLD] Hi,congratulations

[doug bell]

Does anyone know someone who goes by the user name
Phhd?

The reverse lookup I did on the headers looks like it
may be from someone with an account at Hometown computing.
They serve the Dragonsfire Tor and Elfsea area.
We need to find out who has this virus to stop
these messages and stop it from spreading.  Our list
stops the virus attachments but other users aren't so
lucky.

If you have any ideas on tracking this please let
me know.

Magnus

The header trail:
{This address resolves as genuine}
Received: from mc2-f38.law16.hotmail.com ([65.54.237.45]) by
mc2-s17.law16.hotmail.com with Microsoft SMTPSVC(5.0.2195.4905); Fri, 5 Jul
2002
10:25:15 -0700

{So is this one}
Received: from blackstar.ansteorra.org ([216.62.214.29]) by
mc2-f38.law16.hotmail.com
with Microsoft SMTPSVC(5.0.2195.4905); Fri, 5 Jul 2002 10:25:41 -0700

{And this one}
Received: from blackstar.ansteorra.org (localhost.localdomain [127.0.0.1])by
blackstar.ansteorra.org (8.11.6/8.11.6) with ESMTP id g65HPBq11503;Fri, 5
Jul 2002
12:25:11 -0500

{This one is a valid address too}
Received: from out011.verizon.net (out011pub.verizon.net [206.46.170.135])by
blackstar.ansteorra.org (8.11.6/8.11.6) with ESMTP id g65HOwq11473for
<heralds at ansteorra.org>; Fri, 5 Jul 2002 12:24:58 -0500

{The block 63.104.25.82 has no resolvable DNS but is
owned by Hometown Computing (NETBLK-UU-63-104-24)
1644 W. Henderson    Cleburne, TX 76031 }

Received: from Phhd ([63.104.25.82]) by out011.verizon.net (InterMail
vM.5.01.05.05
201-253-122-126-105-20020426) with SMTP id
<20020705172407.MOFB922.out011.verizon.net at Phhd> for
<heralds at ansteorra.org>;
Fri, 5 Jul 2002 12:24:07 -0500

Message-Id: <20020705172407.MOFB922.out011.verizon.net at Phhd>


_________________________________________________________________
MSN Photos is the easiest way to share and print your photos:
http://photos.msn.com/support/worldwide.aspx