Larry Gilson wrote on Mon, 22 Sep 2003 10:44:29 -0400: > The virus library > documentation and all the messages I have seen indicate that the From and To > are grabbed from multiple locations on the computer and the Subject is > dynamic from hard-coded lists. It says nothing about the MAIL FROM but all > the known sources I have seen messages come from indicate that this > information is also pulled from the users' profile. If any of these viruses > actually do forge the MAIL FROM, I have not seen it. For any grouping of > messages, the MAIL FROM, SMTP server, and first Received line have always > been consistent. >
Yeah, you are right, many of the envelope sender addresses fit to the relay it uses. Kai -- Kai Schätzl, Berlin, Germany Get your web at Conactive Internet Services: http://www.conactive.com IE-Center: http://ie5.de & http://msie.winware.org ------------------------------------------------------- This sf.net email is sponsored by:ThinkGeek Welcome to geek heaven. http://thinkgeek.com/sf _______________________________________________ Spamassassin-talk mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
