On Tuesday 26 October 2004 22:19, Tom & Karen Pino wrote:
> Russell W. Behne wrote:
> >Saturday at 21:06, Randall D. Hobbs wrote:
> >>Yeah, you're right there. I've had people email me asking why I sent them
> >> a virus... I only had to say "I'm running Linux, so I can't send you a
> >> virus". That and "check out the headers - that's what tells the truth".
> >> I recently had about 10 viruses come into my inbox, and the funny thing
> >> is, they were all supposed to be FROM me TO me. Doing a little checking,
> >> I found out that one of my contacts had gotten a virus, and of course it
> >> was spoofing everything. What happens is, the virus raids their address
> >> book, and randomly sends out viruses to everyone in that address book,
> >> and it picks a random user from the address book to spoof from. It took
> >> all of about 30 seconds to figure out where it was coming from - I ended
> >> up going over to her office and cleaning up the system, and the emails
> >> disappeared. Funny how that works...
> >
> >How can you know exactly who it came from? I realize that such mostly
> >comes from infected windoze boxes, and I'm thinking that someone out
> >there who has my email in their address book has a virus which has been
> >spoofing my address, like the one Tom & Karen Pino got. The question is
> >who?
>
> I would like to know this too.  I keep getting things "from" our address
> and I know that it cannot be from this computer.  We have to use a
> password that is changed regularly to send to the ISP.  This is not kept
> on the computer as I am too paranoid.
> Tom

There is no point trying. The "From " address of an email is entirely the 
choice of the sender. You could put anything in there and the mail server 
would accept it. To find the originator you must look at the IP address in 
the headers. But the sender is almost invariably a Trojanned Windows user, or 
someone in China (apologies to Chinese readers) who simply does not care.
The spammers/virus writers have robots that 'scrape' mailing lists like this 
one for valid email addresses, and put them in their Trojanned slaves both as 
senders and recipients. That is why I use a special email identity just for 
this list. Any mail coming to this identity gets immediately sent 
to /dev/null . At the moment I get about 300 a day.
Get yourself a good spam filter. Of course a virus filter is unnecessary.
(But I still use one because it amuses me to see how many viruses get thrown 
my way)

derek
-- 
www.jennings.homelinux.net
http://twiki.mdklinuxfaq.org

____________________________________________________
Want to buy your Pack or Services from MandrakeSoft? 
Go to http://www.mandrakestore.com
Join the Club : http://www.mandrakeclub.com
____________________________________________________

Reply via email to