Maybe if you ask his boss about viruses and show the header, he might be able to answer more clearly :P I would hope folks would at least check their servers before answering in the manner you received, that's just awful :D
-----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of R. Scott Perry Sent: Thursday, June 17, 2004 8:11 PM To: [EMAIL PROTECTED] Subject: Re: [Declude.Virus] Stupid question >given the following message: > >Headers >Received: from ameripride.org [24.199.28.90] by mail.ameripride.org with ESMTP > (SMTPD32-8.05) id AC53428F00FC; Wed, 16 Jun 2004 00:36:19 -0500 >From: [EMAIL PROTECTED] ... >Could I conclude that the Netsky virus was coming from a pc with an internet >ip of 24.199.28.90 or an internet router by the same address? Yes, it definitely did. >I pinged the company owning this IP and they stated bluntly "we know we >don't have any viruses". Since I don't know what a relayed email header >looks like, could it be coming from somewhere else? It's amazing how often people know things they don't know. The computer at 24.199.28.90 definitely is almost certainly infected with Netsky.p. Although it is also ARRC's mailserver, Netsky.p sends directly, and there are no other Received: headers, so it did come from 24.199.28.90. They don't have to believe you, though -- but that's exactly how viruses spread, and the attitude that spammers love, and the attitude that people who receive spam hate. Some guy doesn't want to lose his job, but doesn't realize that he is going to have to admit to having a virus eventually (as their E-mail gets blocked because of all the spam coming from their server). -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers since 2000. Declude Virus: Ultra reliable virus detection and the leader in mailserver vulnerability detection. Find out what you've been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.Virus". The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.Virus". The archives can be found at http://www.mail-archive.com.
