Infected!

[Thomas C. Weedon]

Marty,
The virus gets the address from someone's address book (MicroSoft Outlook
PAB). That means it had to have taken a peek inside someones PAB or it would
not know "who" to put as the sender. I have placed several false address in
my PAB, then when someone copies it, I get return messages saying
"undeliverable" and I know that my address book (PAB file) has been copied.
I can then clean my system. So far, this system works for me. It was Ed
Hartley that gave me the idea.
Tom Weedon

-----Original Message-----
From: discussion-request at nsrca.org
[mailto:discussion-request at nsrca.org]On Behalf Of Martin X. Moleski, SJ
Sent: Thursday, August 21, 2003 8:44 AM
To: discussion at nsrca.org
Subject: Re: Infected!


--On Thursday, August 21, 2003 4:35 AM -0400 "Thomas C. Weedon"
<weedon at wwnet.net> wrote:

> The following individuals have been infected by the latest virus; ...

Tom,

Are you sure the bug isn't spoofing?

If a virus/worm counterfeits the "from" address,
then you can't blame the person whose address is
used in that field for the virus.  It is a third
party that has the problem, not the person that
the e-mail seems to be from.

					Marty #2874


=====================================
# To be removed from this list, send a message to
# discussion-request at nsrca.org
# and put leave discussion on the first line of the body.
#

=====================================
# To be removed from this list, send a message to 
# discussion-request at nsrca.org
# and put leave discussion on the first line of the body.
#