[plug] Thunderbird email anomaly

[Bret Busby]

On Wed, 25 Jul 2007, David Dartnall wrote:

> 
> tim wrote:
>> it's nothing to do with thunderbird, more likely spyware or something on 
>> her. i would suggest she gets her computer virus scanned.
>> are you sure she actually sent you the email and it wasn't an automated 
>> trick?
>> 
>> On 7/25/07, *David Dartnall* <darts at dialix.com.au 
>> <mailto:darts at dialix.com.au>> wrote:
>>
>>     I'm running Ubuntu Feisty with all updates to date:
>>
>>     Email is handled by Thunderbird.
>>
>>     My daughter, living in Pretoria, sent me an email with a url
>>     relating to
>>     an article referring in part to her husband. Clicking on this:
>>     http://www.mg.co.za/articlePage.aspx?articleid=314063&area=/insight/insight__africa/
>>     <http://www.mg.co.za/articlePage.aspx?articleid=314063&area=/insight/insight__africa/>
>>     returned a completely different site:
>>     https://bagend.mrc.ac.za/exchweb/bin/auth/owalogon.asp?url=https://bagend.mrc.ac.za/exchweb/bin/redir.asp%3FURL=http://www.mg.co.za/articlePage.aspx?articleid=314063%2526area=/insight/insight__africa/&reason=0
>>     <https://bagend.mrc.ac.za/exchweb/bin/auth/owalogon.asp?url=https://bagend.mrc.ac.za/exchweb/bin/redir.asp%3FURL=http://www.mg.co.za/articlePage.aspx?articleid=314063%2526area=/insight/insight__africa/&reason=0>
>>     which turns out to be very dodgy!
>>
>>     Transferring the original url to Firefox or Opera both worked fine.
>>
>>     What has gone wrong here?
>>
>>     regards to all,
>>
>>     Dave Dartnall
>> 
> No, I'm sure it was from her, the information was genuine and the news 
> article is correctly accessible transferring the url to firefox and opera 
> rather than clicking on it in the email which opens firefox with the rummy 
> url... You made me think tho' and I tried another email with a url in the 
> body which did work ok in firefox. I'll check with her to see if she's had 
> complaint from anywhere else.
>
> Incidentally, I'm finding that opera displays web sites with frames etc in 
> their correct places while firefox (2.0.0.5) has some difficulty with slight 
> overlaps in some cases. Any comment..?
>
> regards
> Dave D
>
> _______________________________________________


I wonder whether this problem has anything to do with the CERT Advisory 
that was sent in the last week, about Firefox and T'bird.

I suggest viewing the full headers or source code for the message that 
you received.

In PINE, viewing the full headers shows the HTML source code, so showing 
the real URL's for links included in messages, in addition to displayed 
URL's. That could show what URL you received in the message.

That is one of the advantages of PINE; to go to a web page referenced in 
an email, I use "Copy link address", and then when I paste it into a web 
browser URL box, I can see fairly well whether the URL's are the same.

--
Bret Busby
Armadale
West Australia
..............

"So once you do know what the question actually is,
  you'll know what the answer means."
- Deep Thought,
   Chapter 28 of Book 1 of
   "The Hitchhiker's Guide to the Galaxy:
   A Trilogy In Four Parts",
   written by Douglas Adams,
   published by Pan Books, 1992

....................................................