Yep. I then sends to everyone in the users contacts folder. -----Original Message----- From: sui seto [mailto:[EMAIL PROTECTED]] Sent: Tuesday, June 18, 2002 6:41 AM To: MS-Exchange Admin Issues Subject: RE: Virus - Mass Mailing
Thanks Martin. How about the To field? Will the virus grab the address from the same address book (randomly) and puts it in the To field?? That is what I am curios to know. I already asked the user to send me the email if it has not been deleted. Sui > Its most likely Klez. When a computer is infected, it will grab an > email addy out of the infected machines address book, then send the > virus with that persons addy in the from field. So it looks like it > came from somewhere else. The headers tell the truth though. > > We get a couple of complaints each week. > > -----Original Message----- > From: sui seto [mailto:[EMAIL PROTECTED]] > Sent: Monday, June 17, 2002 9:57 PM > To: MS-Exchange Admin Issues > Subject: Virus - Mass Mailing > > > Hi All, > > I have a user who resigned a couple of months ago and I disabled his > account on NT and removed his SMTP address from the system. (for > example, [EMAIL PROTECTED]). One day, he called telling me that his frient > recevied a email from him (from the address [EMAIL PROTECTED]) and that > email was infected with virus. He aksed me why this happened. I don't > know the answer. His account has been disabled and his eamil account > ([EMAIL PROTECTED]) has also been deleted from the system (we are using > Exchange 5.5). Is this something to do with mass mailing by the virus. > In other words, if a pc is infected with an email virus and my user's > email address is on the address book, the virus will impersonate my > user using hisaddress, eg. [EMAIL PROTECTED] and send a virus infected > email to other people on the adress book. Is this possible? I am > confused. > > Thanks for your information. > > Sui > > List Charter and FAQ at: > http://www.sunbelt-software.com/exchange_list_charter.htm List Charter and FAQ at: http://www.sunbelt-software.com/exchange_list_charter.htm List Charter and FAQ at: http://www.sunbelt-software.com/exchange_list_charter.htm
