If it is spoofing, it's pretty elaborate.. have fun with the forensics!
Cub
Return-Path: <[EMAIL PROTECTED]>
Received: from conch.msen.com ([192.168.1.4]) by mta003.verizon.net
(InterMail vM.5.01.06.06 201-253-122-130-106-20030910) with ESMTP
id <[EMAIL PROTECTED]>;
Wed, 28 Jul 2004 12:33:10 -0500
Received: from conch.msen.com (148.59.19.5) by sc010pub.verizon.net
(MailPass SMTP server v1.1.1 - 121803235448JY) with ESMTP id
<4-1008-13-1008-113512-1-1091035989> for mta003.verizon.net; Wed, 28 Jul
2004 12:33:10 -0500
Received: from conch.msen.com ([EMAIL PROTECTED] [127.0.0.1])
by conch.msen.com (8.12.10/8.12.10) with ESMTP id i6SGqjXH004950;
Wed, 28 Jul 2004 12:52:45 -0400 (EDT)
Received: (from [EMAIL PROTECTED])
by conch.msen.com (8.12.10/8.12.7/Submit) id i6SGqjpN004949;
Wed, 28 Jul 2004 12:52:45 -0400 (EDT)
Received: from MIKE.org (bdsl.66.13.216.137.gte.net [66.13.216.137])
by conch.msen.com (8.12.10/8.12.10) with SMTP id i6SGqaXI004910
for <[EMAIL PROTECTED]>; Wed, 28 Jul 2004 12:52:37 -0400 (EDT)
Date: Wed, 28 Jul 2004 09:51:54 -0800
To: "SHOPTALK" <[EMAIL PROTECTED]>
From: "SBBAY" <[EMAIL PROTECTED]>
Subject: Virus Found in message "ShopTalk: Re:"
Message-ID: <[EMAIL PROTECTED]>
MIME-Version: 1.0
Content-Type: multipart/mixed;
boundary="--------nmdjlbblkewwtwmkwdgo"
Sender: [EMAIL PROTECTED]
Precedence: bulk
Reply-To: [EMAIL PROTECTED]
----- Original Message -----
From: "Dave Tutelman" <[EMAIL PROTECTED]>
To: <[EMAIL PROTECTED]>
Sent: Wednesday, July 28, 2004 9:54 AM
Subject: Re: ShopTalk: Re:
> I don't believe I'm actually adding a message to this off-topic thread.
But
> maybe it'll correct the assumption that everybody keeps making, and reduce
> the total number of messages. :-P
>
> These days, viruses almost never come from the person they appear to. They
> generally come from an infected computer belonging to person A, who also
> has people B and C in their address book. The virus on A's computer reads
> the address book, and gins up a message to look like it is from B to C,
and
> plants a copy of itself in that message. That way:
> * It spreads itself to C's computer. Actually, it generates lots of
> infected messages, but none of them looks like it came from A.
> * If caught at C's computer, C cannot figure out whose computer is
> actually infected (it looks like B's computer, but it isn't). So it is
> impossible to warn A.
>
> So it both propagates itself (survival of the "species") and protects its
> own existence (survival of the individual). Very Darwinian behavior.
>
> No cheers!
> DaveT
>
> At 02:16 PM 7/28/04 -0400, Bernie Baymiller wrote:
> >How do you know? Norton says my computer's clean...checks every Friday
> >evening. Could somebody be targeting me with those things?
> >
> >----- Original Message -----
> >From: "Mark A Patton" <[EMAIL PROTECTED]>
> >
> > > MYKEY and SBBAY are infected w/ Music_MP3.exe: [EMAIL PROTECTED]
>
>
>
