From: Barry Margolin (barmar_at_alum.mit.edu)
Date: Fri, 30 Jan 2004 05:45:12 GMT
In article <email@example.com>,
firstname.lastname@example.org (Walter Roberson) wrote:
> In article <sRkSb.108$6W6.email@example.com>,
> Linda <firstname.lastname@example.org> wrote:
> :I have received 2 messages in the last 2 days saying that I sent a virus
> :infected email-one identified it as w32/MyDoomA
> I've received many more than that, and I don't even use Windows.
> If the email messages you received include the message headers,
> have a careful look at the IP address of the system that sent the
> message that is apparently from you. You will probably find that the
> IP address is no-where near yours. The worm is copying or generating
> email addresses from somewhere.
Many worms released in the past couple of years work that way. When
they're propagating, they grab addresses from the user's address book
and use them in forged sender information, so that the bounces go back
to someone else.
-- Barry Margolin, email@example.com Arlington, MA *** PLEASE post questions in newsgroups, not directly to me ***