Are you saying then that the worm possibly harvests emails from either the internet or from cached web pages? --- John C Bullas <jcbullas at nildram.co.uk> wrote: > just as we were talking about spoofed outgoing addresses....... > > The email address below is one used for a car sale here: > > http://www.minimania.com/web/id/4389/ClassDetail.cfm > > on a well visited and spidered site :( > > this email address is NEVER used as an outgoing one AND the > network and PC were turned off at the wall...... > > FB > > >Delivered-To: <tallulah_sale at fbr.nildram.co.uk> > >Date: Fri, 30 Jan 2004 19:51:52 +0100 > >From: Mail.Server at jupiter.nildram.co.uk > >Reply-To: Mail.Server at hansen-racing.com > >Subject: MDaemon Warning - Virus Found > >To: tallulah_sale at fbr.nildram.co.uk > >X-MDaemon-Deliver-To: tallulah_sale at fbr.nildram.co.uk > >X-Actual-From: Mail Server at hansen-racing.com > >X-MDSend-Notifications-To: [trash] > > > >The following message had attachment(s) which contained viruses: > > > >From : tallulah_sale at fbr.nildram.co.uk > >To : debby at hansenracing.se > >Subject : Mail Delivery System > >Date : Fri, 30 Jan 2004 12:51:20 -0600 > >Message-ID: > > > >Attachment Virus name Action > taken > >------------------------------------------------------------------------------ > >text.zip I-Worm.Mydoom.a Message > Deleted > > -- > * * Please support the community that supports you. * * > http://evolt.org/help_support_evolt/ > > For unsubscribe and other options, including the Tip Harvester > and archives of thelist go to: http://lists.evolt.org > Workers of the Web, evolt ! ===== Christopher Mahan chris_mahan at yahoo.com 818.943.1850 cell http://www.christophermahan.com/ __________________________________ Do you Yahoo!? Yahoo! SiteBuilder - Free web site building tool. Try it! http://webhosting.yahoo.com/ps/sb/