On Tuesday 26 October 2004 22:19, Tom & Karen Pino wrote: > Russell W. Behne wrote: > >Saturday at 21:06, Randall D. Hobbs wrote: > >>Yeah, you're right there. I've had people email me asking why I sent them > >> a virus... I only had to say "I'm running Linux, so I can't send you a > >> virus". That and "check out the headers - that's what tells the truth". > >> I recently had about 10 viruses come into my inbox, and the funny thing > >> is, they were all supposed to be FROM me TO me. Doing a little checking, > >> I found out that one of my contacts had gotten a virus, and of course it > >> was spoofing everything. What happens is, the virus raids their address > >> book, and randomly sends out viruses to everyone in that address book, > >> and it picks a random user from the address book to spoof from. It took > >> all of about 30 seconds to figure out where it was coming from - I ended > >> up going over to her office and cleaning up the system, and the emails > >> disappeared. Funny how that works... > > > >How can you know exactly who it came from? I realize that such mostly > >comes from infected windoze boxes, and I'm thinking that someone out > >there who has my email in their address book has a virus which has been > >spoofing my address, like the one Tom & Karen Pino got. The question is > >who? > > I would like to know this too. I keep getting things "from" our address > and I know that it cannot be from this computer. We have to use a > password that is changed regularly to send to the ISP. This is not kept > on the computer as I am too paranoid. > Tom
There is no point trying. The "From " address of an email is entirely the choice of the sender. You could put anything in there and the mail server would accept it. To find the originator you must look at the IP address in the headers. But the sender is almost invariably a Trojanned Windows user, or someone in China (apologies to Chinese readers) who simply does not care. The spammers/virus writers have robots that 'scrape' mailing lists like this one for valid email addresses, and put them in their Trojanned slaves both as senders and recipients. That is why I use a special email identity just for this list. Any mail coming to this identity gets immediately sent to /dev/null . At the moment I get about 300 a day. Get yourself a good spam filter. Of course a virus filter is unnecessary. (But I still use one because it amuses me to see how many viruses get thrown my way) derek -- www.jennings.homelinux.net http://twiki.mdklinuxfaq.org
____________________________________________________ Want to buy your Pack or Services from MandrakeSoft? Go to http://www.mandrakestore.com Join the Club : http://www.mandrakeclub.com ____________________________________________________
