mail5692.pif

[jpollack]

One user on the network occasionally get emails returned to him from an address that he did not send an email. The person who was originally slated for the email never receives their email. The emails are returned with an attachment that states "Your attachment "mail5692.pif" contained a virus: W32.netsky.Q@MM. It was deleted and replaced with this file. Even though we run Norton corporate with up to date clients I went ahead and ran netskyFIX and it did not find any problems. Could this problem be external? Any help please.

John

 

[erikhertzel]

It's probably external with someone that has both addresses in their address book. I am sure the Netsky virus is spoofing the real email address of the sender that is infected. So, you are probably safe.

Check your email headers and that might provide a clue as to where the virus is coming from.

Hope that helps,

Erik

 

[jpollack]

Thanks you vey much.

 

[erikhertzel]

No problem. I enjoy helping and giving any advice. I am sure you would do the same.

 

[crow053]

Mydoom.AO searches online for poster e-mail addresses in which to
send itself to using Google, Altavista, Yahoo and Lycos.

In order to trick users, the worm pretends to be a mail delivery
error message.
Could be this