On Sat, 3 Nov 2001 Thorat_private wrote: > For whatever reason, it seems that I have become the target (or masqueraded > source as the case may be) of an email prank. > > Someone originating from SERVER4 (193.128.138.68 [193.128.138.68]) is > sending out the email portion of the Nimda virus with *my* email address as > the FROM. That is normal behaviour for nimda in fact. It grabs a random email address from your mailbox and uses it as faked "From:" address. Hugo. -- All email send to me is bound to the rules described on my homepage. hvdkooijat_private http://hvdkooij.xs4all.nl/ Don't meddle in the affairs of sysadmins, for they are subtle and quick to anger. ---------------------------------------------------------------------------- This list is provided by the SecurityFocus ARIS analyzer service. For more information on this free incident handling, management and tracking system please see: http://aris.securityfocus.com
This archive was generated by hypermail 2b30 : Mon Nov 05 2001 - 09:24:11 PST