Date:         Sat, 23 Aug 2003 03:37:19 EDT
Reply-To:     JordanVw@AOL.COM
Sender:       Vanagon Mailing List <vanagon@gerry.vanagon.com>
From:         JordanVw@AOL.COM
Subject:      SoBig Virus update - it wasnt me!!
Content-Type: text/plain; charset="US-ASCII"

folks i just ran a virus check, my computer isnt infected, but the worm is
using my name (as well as others) as the sender..  thanks to those who advised
me - it's called "spoofing"..
--------snip--------
Email spoofing
W32.Sobig.F@mm uses a technique known as "spoofing," by which the worm
randomly selects an address it finds on an infected computer. The worm uses this
address as the "From" address when it performs its mass-mailing routine. Numerous
cases have been reported in which users of uninfected computers received
complaints that they sent an infected message to another individual.

For example, "Jane Doe" is using a computer infected with W32.Sobig.F@mm.
Jane is neither using an antivirus program nor has the current virus definitions.
When W32.Sobig.F@mm performs its email routine, it finds the email address of
"Joe Schmoe". The worm inserts Joe's email address into the "From" portion of
an infected message, which it then sends to "John Doe" . Then, John contacts
Joe and complains that he sent him an infected message; however, when Joe
scans his computer, Norton AntiVirus does not find anything, because his computer
is not infected.