Leif Neland wrote: >>> Ok, i see you must have experience. Are there really so many >>> virussender who specify a fake REAL EXIST mail address? >>> >>> Michael Neurohr >> >> Many viruses harvest email addresses from the infected PC user's >> address book and inbox etc and use these as the "From:" address. >> >> And I can verify that this is the case from the number of virus >> bounces we get from clueless sites which still insist on sending the >> (spoofed) senders virus warnings. > > What you can (in most cases) see is the ip of the infected machine.
Bingo. I'd have a little more respect for AV programs if, instead of reporting to the envelope-sender, they did a WHOIS lookup on the sending IP and emailed the virus notification to the responsible party for the narrowest containing subnet. -- Matthew.van.Eerde (at) hbinc.com 805.964.4554 x902 Hispanic Business Inc./HireDiversity.com Software Engineer _______________________________________________ http://lurker.clamav.net/list/clamav-users.html
