Silent virus list
Raymond Dijkxhoorn
raymond at PROLOCATION.NET
Fri Sep 19 12:49:25 IST 2003
Hi!
> > The fake sender's address is selected from the following parts:
> I see that, but those are the "From: " address in the message headers.
> My experience is that the envelope From address bears a strong
> resemblance to the server the mail is routed through and is not the same
> as from "From: " address. Since (Julian will correct me if I'm wrong)
> it's the Sender: address rather than the From: address which is used for
> the alerts, I see no need to treat this as Silent and would rather alert
> the victims when I can.
I have seem copys where the from=<user at xs4all.blah>, so yes you have got a
point there. I still would like to put it on the silent list however. If
we all start sending around the same ammount of mails the virus generates
if will double the mailtraffic the worm would do.
Bye,
Raymond.
More information about the MailScanner
mailing list