Mystery virus message

[AlanHo]

Yesterday I received an Email notification from my ISP that they have deleted an Email sent to me because it has an attachment containing a virus. Nothing unusual about that - I get several such messages per month from my ISP (Blueyonder).

What is unusual is that the "From" address is the home Email address of one of my American friends (whose home Email address is in my Outlook contacts list) and the attachment is called "my.name.zip". (My being my first name and name being my surname)

The mystery is that she is temporarily working 2000 miles away from home, her home computer has not been in use for more than two weeks and she has confirmed her home computer is definitely switched off. The only messages she has sent to me recently have been from her office address which have all arrived OK.

Can anyone offer an explanation.

:dummies:

[Agent Smith]

Hi alan, most modern viruses simply spoof the from address for any mails they send. When a machine gets infected, the virus will read the address book on that machine, and select at random an address to send to, and an address to use as it's sent from address.

We stop in excess of 100 mails a day at work, and part of my responsibility is to check these. I have not had a single infected mail this year actually arrive from the address it has claimed to come from.

The fact that the attachment bears your name, is quite simple really. In most peoples address books, as well as the email address, they contain your name. All the virus needs to do, is use the name associated with the email address for it's payload. This makes the mail appear more "genuine" to the intended recipient.

I would stake my reputation (not that I am staking that much really :D ) on the fact that the mail you had blocked, did NOT come from your American friend. It is possible that another acquaintance, who has both your details, is the one infected however. If I had a copy of the mail headers, I might be able to work out roughly where it came from (by that, I mean which ISP was used, and depending on the ISP, which general geographic location. If it came from a business with a registered IP address and their own mail server, I would be able to be totally specific where it came from).

Hope this helps. Mr. M.

[AlanHo]

Thanks for such a prompt and thorough response.

Unfortunately the ISP simply delete the message from the server and send me an Email which gives only the subject line, name of any attachments, Email address of sender and identity of virus or worm (in this case netsky something or other).

It seems that I need to give the bushes a good shaking by contacting all mutual acquaintances who have both my details and my friend's details in their computers and accuse them of being virused. Fortunately I can narrow it down to only 4 or 5 people.

Thanks for your advice - it is appreciated.

.

[Agent Smith]

It seems that I need to give the bushes a good shaking by contacting all mutual acquaintances who have both my details and my friend's details in their computers and accuse them of being virused. Fortunately I can narrow it down to only 4 or 5 people.

If only it were that simple :(

It is entirely possible, that the virus has come from somebody you don't actually know. These viruses have a habit of being able to pass on email addresses with impunity, so it could have come from anywhere :censored:

So be careful, before you go upsetting your friends.

Mr. M.

[nellie2]

A forum member recieved an email.... supposedly from me, a couple of weeks ago. It was invested with a virus and he contacted me to let me know... as you would.

Well I tore my machine apart and finally investigated the email, my address had been spoofed and there is no way of really knowing where the email originated or where it got my addy from.... I mean the email that my friend got originated in America I think but I haven't a clue who the sender was/is.