In the past weeks my FREE (SBC) Yahoo! Mail client [Inbox] and [Bulk] folders have received five messages from different senders that contain a 48 KB 'executable' attachment.

There is some indication that this attack is related to the merger of MSN and Yahoo! Instant Messenger[IM](SVC) announced this week.

Do not ever open a message from a sender unknown to you with attachments. If you are lucky, all it will be is SPAM, so better safe than sorry.

Forward the message to the abuse desk of your ISP and the sender's ISP.
Contact your local FBI Field Office and/or state AG Cyber-crime unit and ask them to investigate, but DO NOT OPEN A DIRTY MAIL BOMB!!00

Below are the headers and attached files filename.s01 from the messages I've received:

From [email protected] Thu Oct 13 00:21:10 2005
X-Apparently-To: [email protected] via 206.190.37.134; Thu, 13 Oct 2005 23:40:47 -0700
X-YahooFilteredBulk: 62.248.2.52
X-Originating-IP: [62.248.2.52]
Return-Path:
Authentication-Results: mta261.mail.scd.yahoo.com from=hayalevi.com; domainkeys=neutral (no sig)
Received: from 62.248.2.52 (EHLO hayalevi.com) (62.248.2.52) by mta261.mail.scd.yahoo.com with SMTP; Thu, 13 Oct 2005 23:40:47 -0700
From: [email protected] Add to Address Book Add Mobile Alert
To: [email protected]
Subject:
Date: Thu, 13 Oct 2005 10:21:10 +0300
MIME-Version: 1.0
Content-Type: multipart/mixed; boundary="----=_NextPart_000_0001_3090C1F9.9F4A3335"
X-Priority: 3
X-MSMail-Priority: Normal
Content-Length: 50579

Attachments Files: document.zip

-------------------------------------------------------------------------

X-Apparently-To: [email protected] via 206.190.37.141; Thu, 13 Oct 2005 09:45:57 -0700
X-YahooFilteredBulk: 62.248.2.52
X-Originating-IP: [62.248.2.52]
Return-Path:
Authentication-Results: mta211.mail.mud.yahoo.com from=mynet.com; domainkeys=neutral (no sig)
Received: from 62.248.2.52 (EHLO mynet.com) (62.248.2.52) by mta211.mail.mud.yahoo.com with SMTP; Thu, 13 Oct 2005 09:45:57 -0700
From: [email protected] Add to Address Book Add Mobile Alert
To: [email protected]
Subject: HELLO
Date: Thu, 13 Oct 2005 07:46:44 +0300
MIME-Version: 1.0
Content-Type: multipart/mixed; boundary="----=_NextPart_000_0007_870250C0.0F6551EB"
X-Priority: 3
X-MSMail-Priority: Normal
Content-Length: 50495

Attached Files: doc.pif

-------------------------------------------------------------------------
X-Apparently-To: [email protected] via 206.190.37.139; Sun, 09 Oct 2005 23:33:01 -0700
X-YahooFilteredBulk: 62.248.2.52
X-Originating-IP: [62.248.2.52]
Return-Path:
Authentication-Results: mta247.mail.mud.yahoo.com from=kizilirmak.nom.tr; domainkeys=neutral (no sig)
Received: from 62.248.2.52 (EHLO kizilirmak.nom.tr) (62.248.2.52) by mta247.mail.mud.yahoo.com with SMTP; Sun, 09 Oct 2005 23:33:01 -0700
From: [email protected] Add to Address Book Add Mobile Alert
To: [email protected]
Subject: Error
Date: Sat, 8 Oct 2005 00:47:30 +0300
MIME-Version: 1.0
Content-Type: multipart/mixed; boundary="----=_NextPart_000_0008_96F000AA.14EFD047"
X-Priority: 3
X-MSMail-Priority: Normal
Content-Length: 50624

Attached Files: text.zip

-------------------------------------------------------------------------
X-Apparently-To: [email protected] via 206.190.37.136; Fri, 07 Oct 2005 22:15:44 -0700
X-YahooFilteredBulk: 62.248.2.52
X-Originating-IP: [62.248.2.52]
Return-Path:
Authentication-Results: mta126.mail.scd.yahoo.com from=counter12.sextracker.com; domainkeys=neutral (no sig)
Received: from 62.248.2.52 (EHLO counter12.sextracker.com) (62.248.2.52) by mta126.mail.scd.yahoo.com with SMTP; Fri, 07 Oct 2005 22:15:44 -0700
From: [email protected] Add to Address Book Add Mobile Alert
To: [email protected]
Subject: Mail Delivery System
Date: Fri, 7 Oct 2005 10:54:06 +0300
MIME-Version: 1.0
Content-Type: multipart/mixed; boundary="----=_NextPart_000_0000_4B852BF6.7383700F"
X-Priority: 3
X-MSMail-Priority: Normal
Content-Length: 50579

Attached Files: document.zip

--------------------------------------------------------------------------

X-Apparently-To: [email protected] via 206.190.37.134; Fri, 07 Oct 2005 05:23:17 -0700
X-YahooFilteredBulk: 62.248.2.52
X-Originating-IP: [62.248.2.52]
Return-Path:
Authentication-Results: mta257.mail.mud.yahoo.com from=msdirectservices.com; domainkeys=neutral (no sig)
Received: from 62.248.2.52 (EHLO msdirectservices.com) (62.248.2.52) by mta257.mail.mud.yahoo.com with SMTP; Fri, 07 Oct 2005 05:23:17 -0700
From: [email protected] Add to Address Book Add Mobile Alert
To: [email protected]
Subject: HI
Date: Fri, 7 Oct 2005 04:07:31 +0300
MIME-Version: 1.0
Content-Type: multipart/mixed; boundary="----=_NextPart_000_0008_FA1BD4E5.C03CD01E"
X-Priority: 3
X-MSMail-Priority: Normal
Content-Length: 53042


Attached Files: message.zip