Can anyone please tell me how to figure out where in the world this junk is
coming from?
I thought that I could just look at the header of the message and be able to
tell, but since several of the messages have my address in the return-path
(which I'm still not sure I understand, unless the virus is spoofing that),
but I've been getting alot of these messages returned to me as undeliverable
and I'm trying to track down where it's originating.
I looked at the Reply-To entry in the header and that looks to be a better
possibility.
Can someone please help explain this to me?
The attachments vary from .scr to .pif to .exe + one html or jpg file.
Here's a copy of one of the headers.
===================================================================
Return-Path: [EMAIL PROTECTED]
Received: from 10.1.1.33 ([10.1.1.33] verified)
by atchisonkansas.net (Stalker SMTP Server 1.8b9d14)
with SMTP id S.0000198408; Sat, 04 Jan 2003 11:42:55 -0600
Received: from [207.241.128.21] (HELO smtp01.journey.com)
by atchisonkansas.net (Stalker SMTP Server 1.8b9d14)
with ESMTP id S.0000198407 for <[EMAIL PROTECTED]>;
Sat, 04 Jan 2003 11:40:38 -0600
Received: from Cpuarwpsq (mkc-65-30-67-139.kc.rr.com
[65.30.67.139])
by smtp01.journey.com (Postfix) with SMTP id 313F97343B
for <[EMAIL PROTECTED]>; Sat, 4 Jan 2003 13:05:32
-0500 (EST)
Sender: [EMAIL PROTECTED]
Errors-To: [EMAIL PROTECTED]
Reply-To: bsmayer <[EMAIL PROTECTED]>
Message-Id: <[EMAIL PROTECTED]>
MIME-Version: 1.0
Content-Type: multipart/alternative;
boundary=Viluus87KmirG7960S
Precedence: Bulk
X-Listserver: Macjordomo 1.5 - Macintosh Listserver
Date: Sat, 4 Jan 2003 13:05:32 -0500 (EST)
From: bsmayer <[EMAIL PROTECTED]>
To: Multiple recipients of AtchiCINBoard <[EMAIL PROTECTED]>
Subject: [ATCHICIN BOARD] Welcome to my hometown
===================================================================
Thanks for any help.
Chris Wagner
#############################################################
This message is sent to you because you are subscribed to
the mailing list <[EMAIL PROTECTED]>.
To unsubscribe, E-mail to: <[EMAIL PROTECTED]>
To switch to the DIGEST mode, E-mail to <[EMAIL PROTECTED]>
To switch to the INDEX mode, E-mail to <[EMAIL PROTECTED]>
Send administrative queries to <[EMAIL PROTECTED]>
