Rowan Collins: This message was not sent by me, but by host213-186.pool8173.interbusiness.it, as the headers show. It uses a forged From: line. It is, in fact, the W32/Netsky.AN worm or a variation thereof, which uses subject lines like "Re: hi" and body text like "why should I?". http://www.pspl.com/virus_info/worms/netskyan.htm Like many email worms, it uses addresses picked up from the infected system, that is, the forged sender is *not* the infected user. wikitech-l allows posts from subscriber addresses immediately to the list, but it strips attachments, so you don't get the actual worm payload. Authentic email from me always includes my real name in the From: line (though this is of course by no means sufficient to verify its origin). HTH, Erik

On 21/10/05, Erik Moeller <erik_moeller(a)gmx.de> wrote: D'oh! Should have thought of that. Damn spoofable protocols. And damn non-human e-mails. And, obviously, damn worms [and their writers]. Out of interest, I thought there was an SPF filter running on the mailing list server; the only "Received-SPF" header I can see seems to be comparing against the line "Sender:wikitech-l-bounces@..." and succeeding. Is it just obscuring the previous one? Anyway, sorry. -- Rowan Collins BSc [IMSoP]