On Wed, 04 Jan 2006 at 10:35:20 -0600, Derek Lamparty wrote: > I am getting hammered by worm.sober.u-3. What are the characteristics of > this worm? Can it spoof ip addresses in the mail server logs? I was trying > to track some of the viruses back to the origination point (there are a lot > of them) to let our members know that they might have a virus. I contacted > a couple and they said that their networks are clean.
Quite likely. The principle is sad nowadays: you can't trust any mail headers beyond your own mailserver's ones. -- Tomasz Papszun SysAdm @ TP S.A. Lodz, Poland | And it's only tomek at lodz.tpsa.pl http://www.lodz.tpsa.pl/iso/ | ones and zeros. tomek at clamav.net http://www.ClamAV.net/ A GPL virus scanner _______________________________________________ http://lurker.clamav.net/list/clamav-users.html
