At 10:48 AM 3/19/2004 -0600, jerrymoos ushered forth:
>Just received the message below, supposedly from the CR host site. This is
>very similar to a hoax supposedly from my inernet service provider saying
>the service would be interrupted for two days unless one went to a link to
>configure an "autoforwarding" service. There have been similar hoaxes on
>corporate networks.
It's a hoax alright, but it's not being spread by any particular individual. It is being promulgated by a worm -- the worm that is installed by executing the (fortunately detached) attachment to the message itself. It is one of many variants of the bagle/beagle worm. Executing the attachment plants the worm on one's local machine, and it spreads itself from there.
http://securityresponse.symantec.com/
Its presence on this list means that some subscriber to the list has the worm on their machine.
rgds, Dave Baseley, just in from cleaning out yet another late winter snowfall in Berks County PA