Does Lirva send from a genuine address?

G Welter G.Welter at ROCLEIDEN.NL
Mon Jan 13 09:26:58 GMT 2003


>From the mcafee page you mentioned below:

The worm uses the default SMTP server of the infected computer, and then adds either the address of the sender or a randomly selected email address to the "From:" line of the email.

So it seems to me that the from address is bogus. So yes, it should be added to the silent viruses.


>>> paul at ESPMAIL.CO.UK 01/13/03 10:15AM >>>
Just wondering whether Lirva is one of those viruses that sends itself using
a bogus email address and therefore not worth notifying the sender about?

I have looked at the Symantec site
( and at
Frisk's site ( and can't
find anything to indicate this.

More information about the MailScanner mailing list