On Thu, Jul 22, 2010 at 1:56 AM, Lisa Kachold <lisakachold@obnosis.com> wrote:

I doubt this is a spambot. SportdocPC is not a known spam bot or spam infection from malware.

I imagine this is just an imbedded HTML message inclusion footer.

Be brave! Click on it and see?

On Wed, Jul 21, 2010 at 6:49 PM, Joseph Sinclair <plug-discussion@stcaz.net> wrote:
If you view the source of the message (it'll be pure ASCII) you should be able to search for the attachment boundary for 82E5A786026D48CFB93EDE028A88F0EB, and see what MIME type it is (or claims to be).
My guess is that it's an HTML or image attachment containing a bogus advertisement (considering SportdocPC is a spam tag). Quite possibly, your friend is using a spam-supported program of some sort (many "fun desktop widget" programs are in this category) or is infected with a spambot.

Dazed_75 wrote:
> I appreciate the info but I'm not sure it explains anything. My suspicion
> is that it might be a link to some embedded malware or something nasty. The
> fact that hovering the mouse over the link shows the resolution to be
> "about:blank" and that there was an image attached to the email make me
> wonder if it might point to something embedded in the image that purports to
> be the "about:blank" page but also contains some kind of malware.
>
> I did not want to click on it even though I was on linux. I did want to try
> to figure it out in case I should let my friend know about it (he runs
> windows). I have no idea how to figure that out.
>
> On Mon, Jul 19, 2010 at 3:22 PM, James Finstrom <
> jfinstrom@rhinoequipment.com> wrote:
>
>> The Uniform Resource Locator (URL) schemes, "cid:" and "mid:" allow
>> references to messages and the body parts of messages. For example,
>> within a single multipart message, one HTML body part might include
>> embedded references to other parts of the same message.
>>
>> http://www.ietf.org/rfc/rfc2111.txt
>>
>> On Mon, Jul 19, 2010 at 3:19 PM, Dazed_75 <lthielster@gmail.com> wrote:
>>
>>> Got an email from a friend. It includes a link that looks strange and
>>> seems to have no place in the context of the email. Hovering the cursor
>>> over it seems to show that it resolves to "about:blank". Here is is with
>>> some spaces inserted to make it not be active:
>>>
>>> cid : 82 E5A786026D48CFB93EDE028A88F0EB @ SportdocPC
>>>
>>>
>>> Anyone know?
>>>
>>>
>>> --
>>> Dazed_75 a.k.a. Larry
>>>
>>> The spirit of resistance to government is so valuable on certain
>>> occasions, that I wish it always to be kept alive.
>>> - Thomas Jefferson
>>>
>>> ---------------------------------------------------

Office: (480)307-8712
AT&T: (503)754-4452

"The war of good and evil present in all religions does not always end, in every faith, with the victory of good, but in every one it establishes a clear order of existence. The sacred as well as the profane rests on that universal order.."
--Stanislav Lem

---------------------------------------------------
PLUG-discuss mailing list - PLUG-discuss@lists.plug.phoenix.az.us
To subscribe, unsubscribe, or to change your mail settings:
http://lists.PLUG.phoenix.az.us/mailman/listinfo/plug-discuss