The virus is sent to addresses found on the infected PC, either from their address book, or maybe from the Web pages they've browsed that it finds in their browser cache, so you're getting them either from someone who's sent you email or one of the many thousands who's visited a Web site with the fireballmedia address on a page.
The "From" is always faked, sometimes with another address found on the infected PC, but often by creating a From: from a fake sender name @ the domain it's going to. So if you are getting a lot that appear to come from fireballmedia then they are probably just being sent to fireballmedia and having that domain also used in the From: One thing you can almost guarantee, if you receive an infected email it DIDN'T come from your PC! ----- Original Message ----- From: "jac" <[EMAIL PROTECTED]> To: <[EMAIL PROTECTED]> Sent: Monday, November 22, 2004 10:07 AM Subject: [wdvltalk] Some advice on Win32.Sober.I - please > Hi Guys, > over the last week or so i've been getting approx. 20-30 emails per day > all containing the known text of the virus Win32.Sober.I - supposedly > from my other domain fireballmedia.ie. So last night I downloaded the > removal tool from Symantec but it didn't find the virus on my machine. > My virus definitions are uptodate & I also did a full scan last night. > I'm always very careful when dealing with emails and potential > infections but I am confused - am i receiving these emails cause my > machine is infected or what?? ANY advice would be appreciated. > > e.g.: > This one came in and Norton had deleted the virus attachement... > > ---------- > > I was surprised, too! > Who_could_suspect_something_like_that? shityiiiii > > > > *-*-* Mail_Scanner: No Virus > *-*-* FIREBALLMEDIA- Anti_Virus Service > *-*-* http://www.fireballmedia.ie > > ---------- > > Thanks a mil! > > jac. > > > > ____ . The WDVL Discussion List from WDVL.COM . ____ > To Join wdvltalk, Send An Email To: mailto:[EMAIL PROTECTED] or > use the web interface http://e-newsletters.internet.com/discussionlists.html/ > Send Your Posts To: [EMAIL PROTECTED] > To change subscription settings or add a password: > http://intm-dl.sparklist.com/read/?forum=wdvltalk > > ________________ http://www.wdvl.com _______________________ > > You are currently subscribed to wdvltalk as: [EMAIL PROTECTED] > To unsubscribe send a blank email to [EMAIL PROTECTED] > > To unsubscribe via postal mail, please contact us at: > Jupitermedia Corp. > Attn: Discussion List Management > 475 Park Avenue South > New York, NY 10016 > > Please include the email address which you have been contacted with. > ____ • The WDVL Discussion List from WDVL.COM • ____ To Join wdvltalk, Send An Email To: mailto:[EMAIL PROTECTED] or use the web interface http://e-newsletters.internet.com/discussionlists.html/ Send Your Posts To: [EMAIL PROTECTED] To change subscription settings or add a password: http://intm-dl.sparklist.com/read/?forum=wdvltalk ________________ http://www.wdvl.com _______________________ You are currently subscribed to wdvltalk as: archive@jab.org To unsubscribe send a blank email to [EMAIL PROTECTED] To unsubscribe via postal mail, please contact us at: Jupitermedia Corp. Attn: Discussion List Management 475 Park Avenue South New York, NY 10016 Please include the email address which you have been contacted with.
