FTST-L Archives

Archiver > FTST > 2002-05 > 1021236427


From: Terry Reigel <>
Subject: OT - [FTST] virus
Date: Sun, 12 May 2002 16:47:24 -0400
References: <001801c1f9ec$0c6aabc0$6401a8c0@flfrd.phub.net.cable.rogers.com> <01b401c1f9ec$8e2a4ee0$6401a8c0@Desktop>


Lady Bonita wrote:

> I have not received one from Robin .. but, I have received a lot of messages
> with attached virus the past month .. at least 1 or 2 day. It is scary ..
> never recognize any of the names. Some were even disguised as 'returned
> message' messages... scary, huh?

The latest viruses are not actually from the person whose name appears in the "from"
line. The virus goes through the victim's hard drive looking for addresses, then
fakes the "from" line with one of addresses it finds. I've found if you display full
headers you can find the actual from person on some other header - don't know if
that's always the case.

The "returned messages" are caused by the faked "from" line - they were actually
undeliverable to the intended target, so were returned to the faked from address,
which was you. But the virus they contain is real.

Terry Reigel

This thread: