Skip to main content
Gerry | Vanagon
Checking account...
← vanagon.com home · Continue the discussion in the forum
Subject:Re: Strange post from L-Soft list server at Vanagon List (1.8d) <LISTSERV@GERRY.VANAGON.COM>
From:Jim Arnott
Date:Thu, 29 Apr 2004 18:32:13 -0700

I wasn't going to bomb the whole list with an answer to an off-topic 
question but since this will otherwise take on a life of its own and it 
is Frydaye GMT, here's what's really happening with such messages:

Virus spoofing

Email-distributed viruses that use spoofing, such the Klez or Sobig 
virus, take a random name from somewhere on the infected person�s hard 
disk and mail themselves out as if they were from that randomly chosen 
address. Recipients of these viruses are therefore misled as to the 
address from which they were sent, and may end up complaining to, or 
alerting the wrong person. As a result, users of uninfected computers 
may be wrongly informed that they have, and have been distributing a 
virus.

And the bounce messages, like what you received, come back to the 
spoofed address.

If you receive an alert that you�re sending infected emails, first run 
a virus scan using McAfee or NAV) or use an on-line scan such as Trend 
Micro's Housecall <http://housecall.trendmicro.com>. If you are 
uninfected, then you may want to reply to the infection alert with this 
information:

�Your virus may have appeared to have been sent by me, but I have 
scanned my system and I am not infected. A number of email-distributed 
viruses fake, or spoof, the �From' address using a random address taken 
from the Outlook contacts list or from Web files stored on the hard 
drive.�

Don't bother.  It just clogs up the Internet.  See next paragraph.

But keep in mind that a virus alert message is quite often auto 
generated and sent via an anti-virus server and so replying to the 
original email may not elicit a response.

Alternatively, if you receive an email-distributed virus, look at the 
Internet Headers information to see where the email actually originated 
from, before firing off a complaint or virus alert to the person you 
assume sent it.

Because that person probably didn't.

Can we learn to use Google? Can we get back to VWs now?

Jim Arnott
Technical Support
Eastern Oregon Net, Inc.