Wasn't it GrimDude who wrote:
>Seems awfully funny that I just happen to know Ian from the boards here, and
>then begin to get spammed (alledgedly) by him.

It may just mean that there's an infected system somewhere that has both
of your addresses in a file that the worm has access to. Several recent
worms scan news and mail systems for addresses and send to one of those
addresses while using another in the faked From line. This helps the
worm spread because it may appear come from someone you know.

The only way to be sure is to track backwards through the "Received"
header lines. Each system adds a Received line when it receives the
message. The first Received header line should show your ISP's mail
server giving the message to your mail client. The last Received header
line should show the originator's system sending it to its ISP's mail
server. There should be a continuity of mail servers from bottom to top,
if there's a discontinuity it may mean that the lower Received lines are
faked. The malware can insert fake Received lines to a message, but it
can't stop real ones being added by each system that it passes through.

-- 
Mike Williams
Gentleman of Leisure

Post a reply to this message