   Is Freddy Fuddpucker a new worm?    
  I think I've isolated a new Outlook-based worm. I'm not a big Windows user, but after searching on Google and CERT I didn't find anything so I do think that it's something new.I've started receiving spam emails from one "Freddy Fuddpucker". The message source for one of the emails is included below. I've removed some information for the purposes of privacy.If this is a new worm, I'd like to either report it or investigate it further. In fact, I was ready to report it but figured it would be prudent to run it by a whole bunch of people quickly (hence this post). What do you think?Return-Path: Return-Path: Received: (Graylien's VALID SMTP SERVER #1)Received: (Graylien's VALID SMTP SERVER #2)(envelope-from freddy_fuddpucker@hotmail.com)Received: from mail pickup service by hotmail.com with Microsoft SMTPSVC; Wed, 11 Sep 2002 15:16:15 -0700Received: from 66.130.89.132 by sea1fd.sea1.hotmail.msn.com with HTTP;Wed, 11 Sep 2002 22:16:15 GMTX-Originating-IP: [ww.xx.yy.zz]From: "Fred Fudpucker" To: (my email address)Subject: You've been fingered!Date: Wed, 11 Sep 2002 16:16:15 -0600Mime-Version: 1.0Content-Type: text/plain; format=flowedMessage-ID: X-OriginalArrivalTime: 11 Sep 2002 22:16:15.0067 (UTC) FILETIME=[D7F79AB0:01C259E0]Have you ever danced with the devil in the pale moonlight?Freddy gives the finger!Be good. Stay real._________________________________________________________________MSN Photos is the easiest way to share and print your photos: http://photos.msn.com/support/worldwide.aspxThe X-Originating-IP    of ww.xx.yy.zz    is actually the ip address of a friend of mine (who I know uses a version of Outlook). Occasionally the To:    field is given as "freddy_fuddpucker@hotmai.com" instead of the actual recipient (NB: that's hotmai    and not hotmail).I also notice that the MIME contents, especially all the usual HTML associated with hotmail accounts, is absent. However, the MSN footer (just text in this case) changes in some emails.The message varies, and for the sake of completeness here are some others (in case some of you can identify "freddy" as a variant of some other worm):-------------------------------Subject: You've been fingered.Freddy gave you the finger!Be good.Stay real.-------------------------------Subject: DreamsTime to eat my dust.  I'll make your wildest dreams come true!Be good. Stay real.F-------------------------------Subject: Bite the bulletYou've been showered with love!Freddy says: Bite the bullet.Be good. Stay real.-------------------------------Subject: (none)Freddy says:  Frenchies fuck for fun!  Fortunately for you.Feel good. Stay real.-------------------------------Freddy says: Finger foods are friggin' good!  Eat some of that, will ya.Stay good. Be real.-------------------------------[edited by - Graylien on September 16, 2002 12:04:57 PM]
  Are you sure its not just your friend playing a joke on you because he downloaded some script kiddie app to do fake email (or maybe he actually knows how to use telnet or write his own email app).  ;  It looks like a worm to me, or otherwise a really creative spammer.  ;  Michalson that was so quick it was creepy. I''m sure that it''s not a trick. I called the person at ww.xx.yy.zz up and asked; he''s been getting the same emails along with everyone else on his network. It seems that everyone in his address book gets spammed with "Freddy Fuddpucker" emails whenever he is working online with Outlook.  ;  One more thing: all people being spammed by "Freddy" have also seen a massive increase in the amount of "normal" spam over the last few days. I have yet to check the source IP address of any spam email, however. I have a feeling that the two are related, because normally I only get about 5-6 spams a year ... and this week alone I''ve received dozens.  ;  Notice the "text/plain". There is no payload or code to be run (unless you did not list some attachments). I see 2 non-prank explanations:A) There are two parts, a worm and a benign message. When the worm is run on a machine it sends out itself to % of the addresses and a random "freddy" message to the other % (it could be random how many get the real thing and how many get the finger). This *may* be the case since it could be bouncing around a small network, and only a few random times does the actual worm go to an outside email address (the rest of the time outside email addresses just get the finger).B) Its a program running on another computer(s) (either known or unknown, it could be a trojan/virus) that gets itself an address list and starts sending the spam.