Following is the header from a virus.
Notice the viri attempts to tamper with the sender's email address
by changing ONE letter in the Return-path & "From " line as opposed
to the correct address in the "From:" line.
Is there any way to trap these differences during smtp to refuse with
a 550 ?
|From iereford@??? Fri Dec 14 16:08:25 2001
|SUBJECT: Mdb - Simply Database;DBQ=C: SIMDATA SIMPLY.
|Date: Fri, 14 Dec 2001 16:07:59 -0800
|Return-path: <iereford@???>
|Envelope-to: message filter
|Delivery-date: Fri, 14 Dec 2001 16:08:25 -0800
|FROM: The Brigdens <hereford@???>
|X-MSMail-Priority: Normal
|X-Priority: 3
|X-Mailer: Microsoft Outlook Express 5.00.2314.1300
|MIME-Version: 1.0
|Content-Type: multipart/mixed;
| boundary="----=_NextPart_000_008B_01D76B07.3C6B0770"
|Content-Transfer-Encoding: 7bit
|Message-Id: <E16F2Mw-000KSc-00@???>
|Bcc:
|X-Envelope-To: e16efpl-0001va-00@???
|This is a multi-part message in MIME format.
|------=_NextPart_000_008B_01D76B07.3C6B0770
|Content-Type: text/plain; charset=ISO-8859-1
|Content-Transfer-Encoding: 7bit
--
Jim Pazarena mailto:paz@qcislands.net
http://www.qcislands.net/paz
