A client of ours (Mr. Otto) has a client of his (Mr. Grimm), who was
infected with some sort of virus. (Sorry for the lack of details, but we're
getting this all second-hand). Mr. Grimm's virus caused his system to send
out a flood of messages to everyone in his address book, including Mr.Otto.
Supposedly, Mr. Grimm turned off his system or otherwise disconnected from
the Internet yesterday afternoon, yet Mr. Otto continues to receive these
flood messages at about once every 30 seconds. Mr. Otto then called us to
ask for advice.
I figure on three possible scenarios:
1. Mr.Grimm's system is really still up and infected, and generating new
messages.
2. Mr. Grimm's ISP or some other third partly is infected, and sending
messages that list Mr. Grimm in the from: line.
3. There are so many of these messages floating out in the Net that they
just haven't all made it to their destination.
I consider Scenario 3 unlikely because it's been a day since Mr. Grimm
disconnect his system. Scenario 1 is unlikely if Mr. Grimm did what he says
he did (disconnect), but I don't know him, so I don't really know whether he
knows what he's doing. I don't know whether Scenario 2 could really happen.
Mr. Otto forwarded us a copy of the header from one of Mr. Grimm's messages.
Here it is:
for <[EMAIL PROTECTED]>; 29 Jul 2001
22:49:56 -0000
Received: from smtp.onemain.com
(dialup-4-hutchinson1.southwind.net [209.134.89.4])
by epic.mail.pas.earthlink.net (8.9.3-EL_1_4/8.9.3)
with SMTP id PAA04297;
Sun, 29 Jul 2001 15:50:21 -0700 (PDT)
Date: Sun, 29 Jul 2001 15:50:21 -0700 (PDT)
Message-Id:
<[EMAIL PROTECTED]>
FROM: Carl or Saundra Grimm <[EMAIL PROTECTED]>
SUBJECT: North Halstead
Hutchinson, KS 67502
Does anyone have any idea what is going on, or how to figure this out?
Ben Bednarz
BC Web
Please visit http://www.ipswitch.com/support/mailing-lists.html
to be removed from this list.
An Archive of this list is available at:
http://www.mail-archive.com/imail_forum%40list.ipswitch.com/
