Re: Current "Swen" worm attack - the best address

[aek@vib.usr.pu.ru (Alexander Kopilovitch)]

Wes Groleau wrote:

> >>... most spammer support programs routinely add
> >>one or more fake headers to make it appear that
> >>the origin is one or more hops further than it is.
> >>
> >>The headers posted appear to contain that sort of forgery.
> >
> > Does this mean that probably that time a spammer was infected? -;)
>
> No, unless the virus is also a spam tool.
>
> It means that this spammer technique was included
> in the virus's SMTP engine, probably for the same
> reason spammers do it: to lengthen the time before
> someone goes to the correct source and stops it.

But from where this virus got that particular, apparently non-existed, but
good-looking and funny address? Note, that this is very rarely case in the
whole stream; in fact I encountered only 2 funny addresses both were in
gouv.fr domain, but first included personal name, therefore it was not so
purely funny; and my collection of those "sender's" addresses from that stream
clearly suggests that the virus does not invent them, but took them from some
source. So, one may guess that that address was used by the infected user for
his own spam, and just reused by the virus... well, yes, it is just vague
possibility, no more.



Alexander Kopilovitch                      aek@vib.usr.pu.ru
Saint-Petersburg
Russia