[rescue] Notify about your e-mail account utilization.

[Lionel Peterson]

> From: Wes Will <wwill at siu.edu>
> Date: 2004/03/17 Wed PM 04:51:26 GMT
> To: The Rescue List <rescue at sunhelp.org>
> Subject: Re: Re: [rescue] Notify about your e-mail account utilization.

> No, it means that the address of somebody on this list
> (and this list address) is in the Windows/LookOUT!
> address book and/or a web cache on a Windows machine
> that got infected.  The "From:" or "ReplyTo:" headers are
> never (not thus far, and we see thousands of these
> things a day) correct.
> 
> 
> It may not be a current list member, or even a list member at all.

Wait, the code only runs on windows boxes, right?

And this list only allows email from list members, right?

The only way a virus email can get on the list is by "pretending" to come from a valid list member and it has to "discover" the list email address, right?

Since the code only runs on Windows, I don't see how it can come from anyone else... The machine that runs the virus needs to know about the maillist, right? I don't see how you get around that requirement (agreed, it could come from archive/cache/whatever, but it has to exist local to the virus).

I may certainly be wrong, if so please do correct me - I am sincerely curious what your thougths are...