IP spoofing may deliver a few packets seeming to come from another source, but I don't think you'd be able to establish a complete connection and deliver an email :)
I've been in his situation before, but you really end up with 2 choices. 1 - Wait until it becomes a serious error and you look bad, especially when you've been alerted there could be an issue and ignored it. 2 - take the information and do everything possible to clear up the issue and make yourself look good for looking ahead. -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Doug Anderson Sent: Friday, June 18, 2004 10:37 AM To: [EMAIL PROTECTED] Subject: Re: [Declude.Virus] Stupid question This isn't someone we know. I looked them up based on the admin messages we were getting from declude.virus+mcaffee and they're a technology consulting firm - which could explain the arrogance. I responded back to his (director of operations) email. He claimed that they might of been ip spoofed, so I pointed out that they better check. infected or spoof...it doesn't look good for a tech firm! ----- Original Message ----- From: "Mike Hyslip" <[EMAIL PROTECTED]> To: <[EMAIL PROTECTED]> Sent: Thursday, June 17, 2004 7:18 PM Subject: RE: [Declude.Virus] Stupid question > Maybe if you ask his boss about viruses and show the header, he might be > able to answer more clearly :P > I would hope folks would at least check their servers before answering in > the manner you received, that's just awful :D > > -----Original Message----- > From: [EMAIL PROTECTED] > [mailto:[EMAIL PROTECTED] On Behalf Of R. Scott Perry > Sent: Thursday, June 17, 2004 8:11 PM > To: [EMAIL PROTECTED] > Subject: Re: [Declude.Virus] Stupid question > > > >given the following message: > > > >Headers > >Received: from ameripride.org [24.199.28.90] by mail.ameripride.org with > ESMTP > > (SMTPD32-8.05) id AC53428F00FC; Wed, 16 Jun 2004 00:36:19 -0500 > >From: [EMAIL PROTECTED] > ... > > >Could I conclude that the Netsky virus was coming from a pc with an > internet > >ip of 24.199.28.90 or an internet router by the same address? > > Yes, it definitely did. > > >I pinged the company owning this IP and they stated bluntly "we know we > >don't have any viruses". Since I don't know what a relayed email header > >looks like, could it be coming from somewhere else? > > It's amazing how often people know things they don't know. The computer at > 24.199.28.90 definitely is almost certainly infected with > Netsky.p. Although it is also ARRC's mailserver, Netsky.p sends directly, > and there are no other Received: headers, so it did come from > 24.199.28.90. They don't have to believe you, though -- but that's exactly > how viruses spread, and the attitude that spammers love, and the attitude > that people who receive spam hate. Some guy doesn't want to lose his job, > but doesn't realize that he is going to have to admit to having a virus > eventually (as their E-mail gets blocked because of all the spam coming > from their server). > > -Scott > --- > Declude JunkMail: The advanced anti-spam solution for IMail mailservers > since 2000. > Declude Virus: Ultra reliable virus detection and the leader in mailserver > vulnerability detection. > Find out what you've been missing: Ask for a free 30-day evaluation. > > --- > [This E-mail was scanned for viruses by Declude Virus > (http://www.declude.com)] > > --- > This E-mail came from the Declude.Virus mailing list. To > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > type "unsubscribe Declude.Virus". The archives can be found > at http://www.mail-archive.com. > > --- > [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] > > --- > This E-mail came from the Declude.Virus mailing list. To > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > type "unsubscribe Declude.Virus". The archives can be found > at http://www.mail-archive.com. > > *Scanned for viruses by Declude Virus* > > *Scanned for viruses by Declude Virus* --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.Virus". The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.Virus". The archives can be found at http://www.mail-archive.com.
