It doesn't do this all the time. McAfee's site states it often changes the second letter of the username. Since at least for me Magistr isn't that a frequent virus I have notification turned on for it because it's rarely that a altered e-mail is coming. Those few bounces I can handle instead of just ignoring them all together since chances are pretty good that some of the e-mails will have the correct e-mail address and a notification will inform this user of their infection so they can take care of it.
Thursday, May 16, 2002, 20:59:45 PM, you wrote: >>I think the hahaha virus is listed as "W95.Hybris.gen". I read on >>Symantec site and couldn't tell if the "Magistr" used forged address. RSP> You are correct. RSP> Magistr uses a forged return address, which is the actual address with the RSP> 2nd character altered (IE "[EMAIL PROTECTED]" would become RSP> "[EMAIL PROTECTED]"). Hybris is the one that uses [EMAIL PROTECTED] RSP> -Scott RSP> --- RSP> [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] RSP> This E-mail came from the Declude.Virus mailing list. To RSP> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and RSP> type "unsubscribe Declude.Virus". You can E-mail RSP> [EMAIL PROTECTED] for assistance. You can visit our web RSP> site at http://www.declude.com . RSP> --- RSP> [This E-mail scanned for viruses by Declude Virus] Best regards, Eje Gustafsson mailto:[EMAIL PROTECTED] --- The Family Entertainment Network http://www.fament.com Phone : 620-231-7777 Fax : 620-231-4066 eBay UserID : macahan - Your Full Time Professionals - --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.Virus". You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com .
