Re: [Shorewall-users] Virus incident

[Gilson S. <gil...@po...>]

Be warned:

Actual virus generates the "From:" and "To:" accessing the Address Book.

So, if user (A) send an email to (B) and another email to (C), it's 
completely possible, as soon as (A) get infected, (A) send an email to (C) 
with a forged "From:" as (B).

Then, (B) and (C) are involved in the email, but the infected machine is (A).

As you describe, "sho...@sh..." is probably (B) or (C), 
not (A).

This kind of warning WAS true when old virus (like Melissa) not forged the 
"From:" in the email.

-Gilson Soares

At 3/30/2004 07:58 AM, you wrote:
>Panda Antivirus has found the following viruses in the message:
>         Server :        NET1
>
>         Sent by :       sho...@sh...
>         Address :       sho...@sh...
>         To :    Franck BAREL
>         Subject :       Re: Your software
>         Date :  04/03/2004  18:28:20
>Sent by You
>
>File :  application_PIF.VIR
>            Virus :      W32/Netsky.D.worm - Disinfected
>
>http://www.pandasoftware.com
>
>
>_______________________________________________
>Shorewall-users mailing list
>Post: Sho...@li...
>Subscribe/Unsubscribe: 
>https://lists.shorewall.net/mailman/listinfo/shorewall-users
>Support: http://www.shorewall.net/support.htm
>FAQ: http://www.shorewall.net/FAQ.htm