Rowan Collins:
On 21/10/05, erik_moeller@gmx.de erik_moeller@gmx.de wrote:
why should I?
Erm... Null context exception: Reply has no parent.
This message was not sent by me, but by host213-186.pool8173.interbusiness.it, as the headers show. It uses a forged From: line. It is, in fact, the W32/Netsky.AN worm or a variation thereof, which uses subject lines like "Re: hi" and body text like "why should I?".
http://www.pspl.com/virus_info/worms/netskyan.htm
Like many email worms, it uses addresses picked up from the infected system, that is, the forged sender is *not* the infected user. wikitech-l allows posts from subscriber addresses immediately to the list, but it strips attachments, so you don't get the actual worm payload.
Authentic email from me always includes my real name in the From: line (though this is of course by no means sufficient to verify its origin).
HTH,
Erik