Does Lirva send from a genuine address?

Paul Welsh paul at ESPMAIL.CO.UK
Mon Jan 13 10:11:39 GMT 2003

----- Original Message -----
From: "G Welter" <G.Welter at ROCLEIDEN.NL>
Sent: Monday, January 13, 2003 9:26 AM
Subject: Re: Does Lirva send from a genuine address?

> >From the mcafee page you mentioned below:
> The worm uses the default SMTP server of the infected computer, and then
adds either the address of the sender or a randomly selected email address
to the "From:" line of the email.
> So it seems to me that the from address is bogus. So yes, it should be
added to the silent viruses.

Sorry, half asleep - didn't notice that, even though I skimmed through the
Symantec article.

More information about the MailScanner mailing list