Note, however, that the From: line on these Nimda variants is also
forged; see http://securityresponse.symantec.com/avcenter/venc/data/w32.nimda.a@mm.html
for details. (I received several messages saying that some mail I sent
was infected with Nimda.E. This struck me as quite improbable, since I
use NetBSD for all my email and other real work.)
--Steve Bellovin, http://www.research.att.com/~smb
Full text of "Firewalls" book now at http://www.wilyhacker.com