W32 Sober virus

[chassis 33]

Someone I know has got this virus on their machine, the problem is I have no idea who as the virus sends the email from a fake/cloned/whatever email address. Is there anyway of figuring out who? Its affecting my @chassis33 address and the same thing is happening to my dads office address, had something like 200 emails each in the past week and its starting to get annoying.

Regards
Iain

[sp60]

I know this doesn't help, but I get about 20 per day as well.
I know a couple of the sources as I send emails to people using different reply addresses depending on who I send too, but until the infected machine is sorted, I guess you keep on getting them. Fortunately it isn't a harmful virus (well, not to the infected machine anyway), just likes to spread itself.

[_dobbo_]

Check the message headers, the bottom-most "Received:" header will contain an IP address - something like this:

Received: from PC018 (blah [81.137.30.145])
by c2bthomr01.btconnect.com (MOS 3.5.9-GR)
with ESMTP id DRT90811;
Mon, 28 Nov 2005 14:26:24 GMT

Use Whois to look up the IP and you should find who the provider is but I'm afraid that's pretty much the limit of what you can do.

[chassis 33]

Just tried one from my dads machine, and its a Onetel Dynamic IP Pool. Bugger.

Had a bit more sucess on my machine, although who they are/why they have my address in their contacts list I dont know, havingsaid thate RIPE only gives the registered owners of the IP address not details on the actual user.

Ho hum, thanks for that! Lets see what I can sort out.

Regards
Iain