Scientology --- For the victims of Scientology

For the victims of Scientology - Virus/Worm Alert
There is an e-mail virus out there with "For the victims of Scientology" in
the subject line. FACTNet might be the only recipient of this. Or we might
not.

This is just a "heads-up" to a.r.s. subscribers and lurkers.

Below, and between, the dotted lines please find 6 header files of e-mails
that had the Klez Virus/Worm attached.

We do not believe these e-mails to have generated by normal (random) Klez
behaviour because:

1/ The subject remains the same: "For the victims of Scientology"

2/ The "X-Apparently-From" remains the same: "RPfaff8907@aol.com"

3/ The subject ("For the victims of Scientology") is not one of the known
Klez subject lines.

4/ The attached infected files are not random and are always the same
("related[1].jpg" or "suicide[2].htm")

We suspect that these e-mails are part of a dirty-tricks campaign

-----------------

Return-Path: <racm0041@bellsouth.net>

Received: from rly-ip06.mx.aol.com ([205.188.156.51] verified)
  by cgpro.iccx.net (CommuniGate Pro SMTP 3.5.7)
  with ESMTP id 166463983 for website@factnet.org; Fri, 07 Jun 2002
15:54:59 -0600
Received: from  logs-ta.proxy.aol.com (logs-ta.proxy.aol.com
[152.163.205.5]) by rly-ip06.mx.aol.com (v83.35) with ESMTP id
RELAYIN4-0607175556; Fri, 07 Jun 2002 17:55:56 -0400
Received: from Mjsvgnbm (AC99347F.ipt.aol.com [172.153.52.127])
 by logs-ta.proxy.aol.com (8.10.0/8.10.0) with SMTP id g57LsBQ22081
 for <website@factnet.org>; Fri, 7 Jun 2002 17:54:11 -0400 (EDT)
Date: Fri, 7 Jun 2002 17:54:11 -0400 (EDT)

Message-Id: <200206072154.g57LsBQ22081@logs-ta.proxy.aol.com>

From: kpb13 <kpb13@aol.com>

To: website@factnet.org
Subject: For the victims of Scientology

 boundary=GZlL76K148Byl6Of47877RNFagM
X-Apparently-From: RPfaff8907@aol.com

--GZlL76K148Byl6Of47877RNFagM

<HTML><HEAD></HEAD><BODY>

<iframe src=3Dcid:P3WG7l359X5x height=3D0 width=3D0>

</iframe>

<FONT></FONT></BODY></HTML>

--GZlL76K148Byl6Of47877RNFagM
 name="Norton AntiVirus Deleted1.txt"

Content-ID: <P3WG7l359X5x>

Tm9ydG9uIEFudGlWaXJ1cyByZW1vdmVkIHRoZSBhdHRhY2htZW50OiBNaWxscy5leGUuDQpU
aGUgYXR0YWNobWVudCB3YXMgaW5mZWN0ZWQgd2l0aCB0aGUgVzMyLktsZXouSEBtbSB2aXJ1
cy4=
--GZlL76K148Byl6Of47877RNFagM
--GZlL76K148Byl6Of47877RNFagM
 name=related[1].jpg
Content-ID: <P3WG7l359X5x>

--GZlL76K148Byl6Of47877RNFagM--

-----------------

Return-Path: <2000@hongkong.com>

Received: from rly-ip06.mx.aol.com ([205.188.156.51] verified)
  by cgpro.iccx.net (CommuniGate Pro SMTP 3.5.7)
  with ESMTP id 166477421 for factnet@factnet.org; Fri, 07 Jun 2002
21:39:23 -0600
Received: from  logs-wq.proxy.aol.com (logs-wq.proxy.aol.com
[205.188.200.132]) by rly-ip06.mx.aol.com (v83.35) with ESMTP id
RELAYIN7-0607234021; Fri, 07 Jun 2002 23:40:21 -0400
Received: from Wqpx (AC83A632.ipt.aol.com [172.131.166.50])
 by logs-wq.proxy.aol.com (8.10.0/8.10.0) with SMTP id g583d0M73792
 for <factnet@factnet.org>; Fri, 7 Jun 2002 23:39:00 -0400 (EDT)
Date: Fri, 7 Jun 2002 23:39:00 -0400 (EDT)

Message-Id: <200206080339.g583d0M73792@logs-wq.proxy.aol.com>

From: kpb13 <kpb13@aol.com>

To: factnet@factnet.org
Subject: For the victims of Scientology

 boundary=I2744n89Hvn4
X-Apparently-From: RPfaff8907@aol.com

--I2744n89Hvn4

<HTML><HEAD></HEAD><BODY>

<iframe src=3Dcid:XhII7673392Hj height=3D0 width=3D0>

</iframe>

<FONT></FONT></BODY></HTML>

--I2744n89Hvn4
 name="Norton AntiVirus Deleted1.txt"

Content-ID: <XhII7673392Hj>

Tm9ydG9uIEFudGlWaXJ1cyByZW1vdmVkIHRoZSBhdHRhY2htZW50OiBocmVmLmJhdC4NClRo
ZSBhdHRhY2htZW50IHdhcyBpbmZlY3RlZCB3aXRoIHRoZSBXMzIuS2xlei5IQG1tIHZpcnVz
Lg==
--I2744n89Hvn4
--I2744n89Hvn4
 name=related[1].jpg
Content-ID: <XhII7673392Hj>

--I2744n89Hvn4--

-----------------

Return-Path: <racm0041@bellsouth.net>

Received: from rly-ip01.mx.aol.com ([205.188.156.49] verified)
  by cgpro.iccx.net (CommuniGate Pro SMTP 3.5.7)
  with ESMTP id 166773828 for factnet@factnet.org; Fri, 14 Jun 2002
01:52:37 -0600
Received: from  logs-mtc-tf.proxy.aol.com (logs-mtc-tf.proxy.aol.com
[64.12.103.5]) by rly-ip01.mx.aol.com (v83.35) with ESMTP id
RELAYIN5-0614035255; Fri, 14 Jun 2002 03:52:55 -0400
Received: from Efwrbgy (ACA93C06.ipt.aol.com [172.169.60.6])
 by logs-mtc-tf.proxy.aol.com (8.10.0/8.10.0) with SMTP id g5D46Cw92897
 for <factnet@factnet.org>; Thu, 13 Jun 2002 00:06:14 -0400 (EDT)
Date: Thu, 13 Jun 2002 00:06:14 -0400 (EDT)

Message-Id: <200206130406.g5D46Cw92897@logs-mtc-tf.proxy.aol.com>

From: website <website@factnet.org>

To: factnet@factnet.org
Subject: For the victims of Scientology

 boundary=EWDhd1rmi7rS4c4Xnb64ktm8eb1FpC
X-Apparently-From: RPfaff8907@aol.com

--EWDhd1rmi7rS4c4Xnb64ktm8eb1FpC

<HTML><HEAD></HEAD><BODY>

<iframe src=3Dcid:C35aBdWB09M9Eo height=3D0 width=3D0>

</iframe>

<FONT></FONT></BODY></HTML>

--EWDhd1rmi7rS4c4Xnb64ktm8eb1FpC
 name="Norton AntiVirus Deleted1.txt"

Content-ID: <C35aBdWB09M9Eo>

Tm9ydG9uIEFudGlWaXJ1cyByZW1vdmVkIHRoZSBhdHRhY2htZW50OiBhbHQuZXhlLg0KVGhl
IGF0dGFjaG1lbnQgd2FzIGluZmVjdGVkIHdpdGggdGhlIFczMi5LbGV6LkhAbW0gdmlydXMu
--EWDhd1rmi7rS4c4Xnb64ktm8eb1FpC
--EWDhd1rmi7rS4c4Xnb64ktm8eb1FpC
 name=suicide[2].htm
Content-ID: <C35aBdWB09M9Eo>

--EWDhd1rmi7rS4c4Xnb64ktm8eb1FpC--

-----------------

Return-Path: <factnet@factnet.org>

Received: from rly-ip01.mx.aol.com ([205.188.156.49] verified)
  by cgpro.iccx.net (CommuniGate Pro SMTP 3.5.7)
  with ESMTP id 166715482 for website@factnet.org; Wed, 12 Jun 2002
23:36:28 -0600
Received: from  logs-mtc-tf.proxy.aol.com (logs-mtc-tf.proxy.aol.com
[64.12.103.5]) by rly-ip01.mx.aol.com (v83.35) with ESMTP id
RELAYIN7-0613001720; Thu, 13 Jun 2002 00:17:20 2000
Received: from Rzmugu (ACA93C06.ipt.aol.com [172.169.60.6])
 by logs-mtc-tf.proxy.aol.com (8.10.0/8.10.0) with SMTP id g5D47Kw140862
 for <website@factnet.org>; Thu, 13 Jun 2002 00:07:25 -0400 (EDT)
Date: Thu, 13 Jun 2002 00:07:25 -0400 (EDT)

Message-Id: <200206130407.g5D47Kw140862@logs-mtc-tf.proxy.aol.com>

From: factnet <factnet@factnet.org>

To: website@factnet.org
Subject: For the victims of Scientology

 boundary=O05FLhH55U09V445629aG0j6AAi351233
X-Apparently-From: RPfaff8907@aol.com

--O05FLhH55U09V445629aG0j6AAi351233

<HTML><HEAD></HEAD><BODY>

<iframe src=3Dcid:CKaEd20m86 height=3D0 width=3D0>

</iframe>

<FONT></FONT></BODY></HTML>

--O05FLhH55U09V445629aG0j6AAi351233
 name="Norton AntiVirus Deleted1.txt"

Content-ID: <CKaEd20m86>

Tm9ydG9uIEFudGlWaXJ1cyByZW1vdmVkIHRoZSBhdHRhY2htZW50OiBhbHQuc2NyLg0KVGhl
IGF0dGFjaG1lbnQgd2FzIGluZmVjdGVkIHdpdGggdGhlIFczMi5LbGV6LkhAbW0gdmlydXMu
--O05FLhH55U09V445629aG0j6AAi351233
--O05FLhH55U09V445629aG0j6AAi351233
 name=related[1].jpg
Content-ID: <CKaEd20m86>

--O05FLhH55U09V445629aG0j6AAi351233--

-----------------

Return-Path: <racm0041@bellsouth.net>

Received: from rly-ip06.mx.aol.com ([205.188.156.51] verified)
  by cgpro.iccx.net (CommuniGate Pro SMTP 3.5.7)
  with ESMTP id 166988304 for factnet@factnet.org; Tue, 18 Jun 2002
18:19:09 -0600
Received: from  logs-mtc-tb.proxy.aol.com (logs-mtc-tb.proxy.aol.com
[64.12.104.5]) by rly-ip06.mx.aol.com (v83.35) with ESMTP id
RELAYIN10-0618201813; Tue, 18 Jun 2002 20:18:13 -0400
Received: from Lhzk (ACA8D7C9.ipt.aol.com [172.168.215.201])
 by logs-mtc-tb.proxy.aol.com (8.10.0/8.10.0) with SMTP id g5IN6DE188055
 for <factnet@factnet.org>; Tue, 18 Jun 2002 19:06:13 -0400 (EDT)
Date: Tue, 18 Jun 2002 19:06:13 -0400 (EDT)

Message-Id: <200206182306.g5IN6DE188055@logs-mtc-tb.proxy.aol.com>

From: kpb13 <kpb13@aol.com>

To: factnet@factnet.org
Subject: For the victims of Scientology

 boundary=D9u0805qd3832
X-Apparently-From: RPfaff8907@aol.com

--D9u0805qd3832

<HTML><HEAD></HEAD><BODY>

<iframe src=3Dcid:YG0Fi000pV51r2lX1C height=3D0 width=3D0>

</iframe>

<FONT></FONT></BODY></HTML>

--D9u0805qd3832
 name="Norton AntiVirus Deleted1.txt"

Content-ID: <YG0Fi000pV51r2lX1C>

Tm9ydG9uIEFudGlWaXJ1cyByZW1vdmVkIHRoZSBhdHRhY2htZW50OiB3aWR0aC5iYXQuDQpU
aGUgYXR0YWNobWVudCB3YXMgaW5mZWN0ZWQgd2l0aCB0aGUgVzMyLktsZXouSEBtbSB2aXJ1
cy4=
--D9u0805qd3832
--D9u0805qd3832
 name=suicide[2].htm
Content-ID: <YG0Fi000pV51r2lX1C>

--D9u0805qd3832--

-----------------

Return-Path: <yatesm@Citadel.edu>

Received: from rly-ip01.mx.aol.com ([205.188.156.49] verified)
  by cgpro.iccx.net (CommuniGate Pro SMTP 3.5.7)
  with ESMTP id 167003420 for factnet@factnet.org; Wed, 19 Jun 2002
03:01:55 -0600
Received: from  logs-wo.proxy.aol.com (logs-wo.proxy.aol.com
[205.188.200.6]) by rly-ip01.mx.aol.com (v83.35) with ESMTP id
RELAYIN1-0619045352; Wed, 19 Jun 2002 04:53:52 2000
Received: from Wdzlfjkd (AC85EA1E.ipt.aol.com [172.133.234.30])
 by logs-wo.proxy.aol.com (8.10.0/8.10.0) with SMTP id g5J4bqD509629
 for <factnet@factnet.org>; Wed, 19 Jun 2002 00:37:52 -0400 (EDT)
Date: Wed, 19 Jun 2002 00:37:52 -0400 (EDT)

Message-Id: <200206190437.g5J4bqD509629@logs-wo.proxy.aol.com>

From: website <website@factnet.org>

To: factnet@factnet.org
Subject: For the victims of Scientology

 boundary=H2zT5123xv46pIz
X-Apparently-From: RPfaff8907@aol.com

--H2zT5123xv46pIz

<HTML><HEAD></HEAD><BODY>

<iframe src=3Dcid:Ql18cz3t1 height=3D0 width=3D0>

</iframe>

<FONT></FONT></BODY></HTML>

--H2zT5123xv46pIz
 name="Norton AntiVirus Deleted1.txt"

Content-ID: <Ql18cz3t1>

Tm9ydG9uIEFudGlWaXJ1cyByZW1vdmVkIHRoZSBhdHRhY2htZW50OiBBbmQuYmF0Lg0KVGhl
IGF0dGFjaG1lbnQgd2FzIGluZmVjdGVkIHdpdGggdGhlIFczMi5LbGV6LkhAbW0gdmlydXMu
--H2zT5123xv46pIz
--H2zT5123xv46pIz
 name=related[1].jpg
Content-ID: <Ql18cz3t1>



--H2zT5123xv46pIz--

-----------------
IOHO
The FACTNet Staff
---
F.A.C.T.Net, Inc.

PO Box 3135
Boulder, CO 80307-3135 USA

   * Web site http://www.factnet.org/
   * Discussion Board http://www.factnet.org/discus/
   * E-mail mailto:factnet@factnet.org
   * Donations http://www.factnet.org/donation.htm
   * Donations by PayPal. Account = manage@factnet.org
   * Subscriptions to Newsletters http://www.factnet.org/Subscribe.html

F.A.C.T.Net is a non-profit 501(c)(3) news source, referral service, and
archive protecting freedom of mind from harms caused by psychological
coercion.
Go Back