Many viruses, including Klez, spoof the "From" address. You need to look in the headers of the original message to work out where it really came from.
Les Bessant MCSE mailto:[EMAIL PROTECTED] IT Manager, Sanderson Townend & Gilbert Acting in a personal capacity http://www.tiggercam.co.uk - New, improved and with more bounce! -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] Sent: 02 August 2002 17:04 To: Exchange Discussions Subject: messages from unknown sender Hi, We're using Exchange 5.5, sp4 and Trend Micro virus scanning which shows no viruses in our system. One of our users received a message from someone they don't know and they said she sent them a message with a suspicious attachment. She doesn't know this person or their email address yet they forwarded a copy of the message she allegedly sent to them. It definitely had her email address but she didn't send it. It looked like a Klez variant (the subject was "How are you"). Any ideas on how this happened? Thanks. _________________________________________________________________ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin: [EMAIL PROTECTED] ________________________________________________________________________ This e-mail has been scanned for all viruses by Star Internet. The information in this communication and any attachments is confidential and may be legally privileged. It is intended solely for the addressee. If you are not the intended recipient any use, review, dissemination, distribution or copying of this information is strictly prohibited. If you have received this communication in error please notify us immediately on 0191 261 2681 and delete the original message and any copies of it. Any opinions, conclusions or other information in this message that do not relate to the official business of Sanderson Townend & Gilbert are neither given nor endorsed by the firm. ________________________________________________________________________ This e-mail has been scanned for all viruses by Star Internet. The service is powered by MessageLabs. For more information on a proactive anti-virus service working around the clock, around the globe, visit: http://www.star.net.uk ________________________________________________________________________ _________________________________________________________________ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin: [EMAIL PROTECTED]
