Re: Redhat-install-list digest, Vol 1 #4342 - 3 msgs

["Ralph E. Kenyon, Jr." <diogenes vgernet net>]

On Sun, 1 Feb 2004 09:36:39 -0800, Victor <vpomar pacbell net> wrote:
> This is the second message I am sending you, Yor email is still coming  
> with viruses attached.

Please don't blame the "From" or "Reply To" address listed in a message as  
the source of a virus infected message.  Those addresses are faked by the  
virus. (The virus uses addresses found on the infected computer.) Look at  
the message header's first.  Here's a typical header:

Return-Path: 	<life rethinkers org>
Received: 	from rethinkers.org  
(ca-lapuente-cuda2-c1a-47.arcdca.adelphia.net [24.54.250.47]) by  
vger.vgernet.net (8.12.4/8.12.6) with ESMTP id i11GhRXx012958 for  
<diogenes vgernet net>; Sun, 1 Feb 2004 11:43:28 -0500	
From: 	life rethinkers org

This message was NOT send from anyone at rethinkers.org.  It was sent from  
24.54.250.47, which does happen to be from a user on line with broadband  
at adelphia.net. If you know how to send a pop-up message, that user just  
might get it, if it is not blocked.

Because many people do not keep their email addresses up-to-date, many  
virus infected message are kicked back to the faked from address as  
undeliverable.  You would get such a message if your address was on the  
infected computer and the virus used it as the return address.  When it is  
rejected, it goes back to the faked return address instead of from the  
true originator.

If you must send a virus report, look up the IP address, find out the true  
domain, check their website for an email address, or try to look up a  
technical contact in whois, and send the report there.  On occasion, when  
I'm getting multiple virus emails originating from the same source, I've  
resorted to telephone calls to the website in question.


--
http://www.xenodochy.org/ralph.html
Using M2, Opera's revolutionary e-mail client: http://www.opera.com/m2/