Does Lirva send from a genuine address?

[Paul Welsh]

----- Original Message -----
From: "G Welter" <G.Welter at ROCLEIDEN.NL>
To: <MAILSCANNER at JISCMAIL.AC.UK>
Sent: Monday, January 13, 2003 9:26 AM
Subject: Re: Does Lirva send from a genuine address?


> >From the mcafee page you mentioned below:
>
> The worm uses the default SMTP server of the infected computer, and then
adds either the address of the sender or a randomly selected email address
to the "From:" line of the email.
>
> So it seems to me that the from address is bogus. So yes, it should be
added to the silent viruses.
>

Sorry, half asleep - didn't notice that, even though I skimmed through the
Symantec article.