Does Lirva send from a genuine address?

[G Welter]

Hi.

>From the mcafee page you mentioned below:

The worm uses the default SMTP server of the infected computer, and then adds either the address of the sender or a randomly selected email address to the "From:" line of the email.

So it seems to me that the from address is bogus. So yes, it should be added to the silent viruses.

Gerben.

>>> paul at ESPMAIL.CO.UK 01/13/03 10:15AM >>>
Just wondering whether Lirva is one of those viruses that sends itself using
a bogus email address and therefore not worth notifying the sender about?

I have looked at the Symantec site
(http://www.symantec.com/avcenter/venc/data/w32.lirva.a@mm.html) and at
Frisk's site (http://www.f-prot.com/virusinfo/lirva_desc.html) and can't
find anything to indicate this.