just as we were talking about spoofed outgoing addresses....... The email address below is one used for a car sale here: http://www.minimania.com/web/id/4389/ClassDetail.cfm on a well visited and spidered site :( this email address is NEVER used as an outgoing one AND the network and PC were turned off at the wall...... FB >Delivered-To: <tallulah_sale at fbr.nildram.co.uk> >Date: Fri, 30 Jan 2004 19:51:52 +0100 >From: Mail.Server at jupiter.nildram.co.uk >Reply-To: Mail.Server at hansen-racing.com >Subject: MDaemon Warning - Virus Found >To: tallulah_sale at fbr.nildram.co.uk >X-MDaemon-Deliver-To: tallulah_sale at fbr.nildram.co.uk >X-Actual-From: Mail Server at hansen-racing.com >X-MDSend-Notifications-To: [trash] > >The following message had attachment(s) which contained viruses: > >From : tallulah_sale at fbr.nildram.co.uk >To : debby at hansenracing.se >Subject : Mail Delivery System >Date : Fri, 30 Jan 2004 12:51:20 -0600 >Message-ID: > >Attachment Virus name Action taken >------------------------------------------------------------------------------ >text.zip I-Worm.Mydoom.a Message Deleted