Re: Virus Emails

On Sat, 27 Jul 2002, Tom Lane wrote:

> One of the nastier aspects of the Klez virus....
>
> However, even a trivial look at the detail mail headers (Received: etc)
> will convince you that the spam did not originate from the claimed
> "From:" address. If you care to post a few sets of complete headers,
> we can probably triangulate pretty quickly on the virus-infected loser
> who's originating these messages.

It appears to me that the envelope sender is not forged by Klez.H,
assuming that that's the virus I'm getting all the time. So you
could check for the "Return-Path:" header, or maybe "From " (note:
no colon) if you're using a Berkeley-mailbox style system, and find
out the e-mail address of the real sender.

cjs
--
Curt Sampson <cjs(at)cynic(dot)net> +81 90 7737 2974 http://www.netbsd.org
Don't you know, in this new Dark Age, we're all light. --XTC