Why the from and the sender are not the same thing?

[Matt Doherty]

The nature of the Klez virus to spoof sender in the header.. Read about the
Klez virus on Symantec.com or somewhere else will explain it.

Matt Doherty
IT Dept
Datawatch Corp

>>In a world without walls or fences, who needs Windows and Gates?<<

  -----Original Message-----
  From: Jonathan Arcand [mailto:jonathan.arcand at CEGEPTR.QC.CA]
  Sent: Tuesday, August 20, 2002 11:37 AM
  To: MAILSCANNER at JISCMAIL.AC.UK
  Subject: Why the from and the sender are not the same thing?


  Hi,

  I received some messages like this:


  > The following e-mail messages were found to have viruses in them:
  >
  > Sender: <Webmaster at cegeptr.qc.ca >
  > Recipient: <infoprog at cegeptr.qc.ca>
  > Subject: Scrolling
  > MessageID: g7KE78FF002666
  > Report: /g7KE78FF002666/Yzdsr.scr Found the W32/Klez.h at MM virus
  !!!
  > Windows Screensavers often hide viruses in email in Yzdsr.scr
  >
  > Full headers are:
  > Return-Path: <g>
  > Received: from Jcdyf (hurricane-ppp29.sorel.cognicase.net
[64.254.11.35])
  > by courrier.cegeptr.qc.ca (8.12.5/8.12.5) with SMTP id g7KE78FF002666
  > for <infoprog at cegeptr.qc.ca>; Tue, 20 Aug 2002 10:07:09 -0400
  > Date: Tue, 20 Aug 2002 10:07:08 -0400
  > Message-Id: <200208201407.g7KE78FF002666 at courrier.cegeptr.qc.ca>
  > From: webmaster <webmaster at johnabbott.qc.ca>
  > To: infoprog at cegeptr.qc.ca
  > Subject: Scrolling
  > MIME-Version: 1.0
  > Content-Type: multipart/alternative;
  > boundary=BBowx3aO8i4OBHwS930B5Us0800A2M03
  >
  > --
  > MailScanner
  > Email Virus Scanner

  I don't understand why the sender is webmaster at my.domain and in the header
  is webmaster at johnabbott.qc.ca

  The user's auto-response goes to webmaster at cegeptr.qc.ca

  I'm using mailsanner 3.20-7 with no spam detection and Mcafee

  Somenone knows what is my problem?
  Thanks!

  Jonathan

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20020820/a0d186d1/attachment.html