Larry Gilson wrote on Sun, 21 Sep 2003 17:13:35 -0400: > I agree with what you are saying about the MAIL FROM command. It is easy > enough to forge. However, I have only seen the header From change and leave > the MAIL FROM command as that configured in the user's profile.
What "user's profile" do you mean? The virus isn't interested in any user profiles. It creates its own email and sends it out with its own SMTP client and uses the same mail from from envelope and header. Not to mention that many of the mails seem to come from original spreaders instead of "just" infected machines. This is > consistent with the virus documentation I have read also. > I don't know any such documentation which says this. Really, you can't rely on this. Even if it were ture in this very limited case it's never true on a broader scale. One would want to use such a program in the longer run and block future viruses and spam spreaders as well. Kai -- Kai Schätzl, Berlin, Germany Get your web at Conactive Internet Services: http://www.conactive.com IE-Center: http://ie5.de & http://msie.winware.org ------------------------------------------------------- This sf.net email is sponsored by:ThinkGeek Welcome to geek heaven. http://thinkgeek.com/sf _______________________________________________ Spamassassin-talk mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
