[plug] W32.Novarg.A at mm

[Jay Turner]

> -----Original Message-----
> From: plug-admin at plug.linux.org.au
> [mailto:plug-admin at plug.linux.org.au]On Behalf Of senectus
> Sent: Tuesday, 27 January 2004 2:31 PM
> To: plug at plug.linux.org.au
> Subject: RE: [plug] W32.Novarg.A at mm
>
>
> Yupp.. Getting hammered by it..
>
> Strange thing occurred too..
> Three days ago I created a new e-mail account at westnet. I haven't used
> this account to send or receive any e-mails and I haven't told
> anyone about
> it.. but somehow I have received the virus in that account.. My guess is
> that westnet is infected and they sent it too me..
>

It appears that the virus may just make up names to pre-pend to domain names
as the 'reply-to' address.

A friend who has a small company with three email accounts and his
configured as the 'catch anything else account' has been seeing email with
reply addresses of:

Jim, James, Tim, Josephine, Dave, Tom, Paul at hiscompany.com etc...

Obviously these accounts have never existed and could never appear in
anyone's address book.
If your account has a common name, this could possibly explain why.

My account 'jturn' has received nothing as yet probably because of this
theory...