We have seen some of this on our network as well. It (I-Worm/Sobig) appears to be just another worm that spreads via email on Windows boxes. Like so many of the others, once it infects a users machine, it collects their email addresses (from WAB, HTML, DBX, EML, and so forth) and sends itself back out to those unsuspecting people. It uses its own SMTP to mail infected messages (which is why it appears to originate from [EMAIL PROTECTED]). The original IP changes because it is actually being sent from various other infected people, as opposed to being sent from one specific person.
So, I don't think you are actually being targeted. You just happen to be in the address book of a few infected people.
Bob
At 10:54 AM 2/7/2003 +0100, you wrote:
Hi guys, For the last two months or so I have been receiving emails with the I-Worm/Sobig virus attached about twice a day. My anti-virus sw protects me well so I am not infected in any way (nor has anybody else here). Initially, I used to ignore the messages and delete them; after a couple of weeks I decided to trace the source IP from the mail header and send complaint messages to the corresponding ISP. But the Bast**d keeps finding other IP's to mail me from. Messages come from [EMAIL PROTECTED] Is anyone else being targeted? Is this a common occurrence? Am I the only one?Cheers! Chris
