The Virus Cometh

[Kenneth Brody]

Jeroen Elias wrote:
> 
> Dear Jim,
> 
> As a Dutch reader of the list, I want to be sure that I am not the one you
> are refering to.
> I do have a virus scanner running (Norton) which ran into some viruses the
> past few weeks.
> Can you please tell me which dutch domain, or if possible, which e-mail
> address has sent
> the virus?
[...]

Unfortunately, based on what I've seen, not only are most of these
virus scanners misconfigured so that they send a "warning" to the
address that they _know_ did not send the virus, but most of them
also strip off the headers of the original message, making it
impossible to see where it really came from.

All of the "bounces" that I've seen which came from a .nl server
have come without the original headers, so I can't help there.

However, I did see a bunch that originated at 65.16.102.202 (which
is host102-202.discord.birch.net), but I haven't seen any legitimate
email from 65.16.*.*, so I don't know who it came from.

-- 

+---------+----------------------------------+-----------------------------+
| Kenneth |     kenbrody at spamcop.net      | "The opinions expressed     |
|    J.   |    http://www.hvcomputer.com     |  herein are not necessarily |
|  Brody  |      http://www.fptech.com       |  those of fP Technologies." |
+---------+----------------------------------+-----------------------------+