Dear Robert,

Thankyou for your continued interest shown in our software and sending your query.

There is nothing to worry about your system is clean if you have updated your copy of
Quick Heal using the latest update.  Let me clear your query.

Most of the recent worms/viruses that do mass mailing are also know to do spoofing sepecially
W32.MyDoom,  Quick Heal detects and removes this worm as W32.Novarg if your copy is updated
using the update provided on 27th Jan or later.

The worm/virus extracts email addresses from an infected system and sends a copy of
them self to each and every Email address found in the infected system. 

In such case, if the receiver is already having protection for that particular virus/worm, may
in return inform the sender about his system being infected.  This will result in the sender
disinfecting his system and the virus loosing one computer to do mass infection.

To avoid the back trace of the source of infection spoofing technique is adopted.

Here, the From: (Senders) email address is a forged one.  The senders email address is also randomly
chosen from the list of email addresses exacted from the infected system.  This creates
confusion.  So the mail will appear to be sent by the person who is actually not infected.

This is exactly what has happened in your case. Your email address is lying in the system of the
system that is infected and hence the virus has used your email address as Sender. The virus is
successful in creating confusion and doing mass infection without disclosing the source.

You can simply ignore such emails.  Just ensure that you update your copy of Quick Heal regularly.
Also ensure that you use Quick Heal messenger utility regularly.  We inform all our users about new
virus alert, updates, new releases using this messenger utility.

In case of any query or difficulty feel free to contact us.

Thanking you,
Regards,






At 10:39 AM 2/8/2004 -0500, you wrote:

Dear Quickheal support,
Despite regular downloading of the most current virus protection you offer, and even downloading and running the Removal utility for the Norvarg (27 January 2004) and all of the regular updates you provide, I recieved the following message shown below in which it appears my system contains and is transmiting the virus to other systems via email....Please help me with this problem....Thank you, Robert Crowther USA  Phone Number (401) 568-1023
 
Attention: crowtherr@...
A virus was found in an Email message you sent.
This Email scanner intercepted it and stopped the entire message
reaching its destination.

The virus was reported to be:

W32/Mydoom.A@mm


Please update your virus scanner or contact your IT support
personnel as soon as possible as you may have a virus on your system.


Your message was sent with the following envelope:

MAIL FROM: crowtherr@...
RCPT TO:   charlie@...

... and with the following headers:

---
MAILFROM: crowtherr@...
Received: from unknown (HELO earthlink.net) (69.1.222.36)
  by 0 with SMTP; 8 Feb 2004 05:57:29 -0000
From: crowtherr@...
To: charlie@...
Subject: hello
Date: Sat, 7 Feb 2004 01:05:43 -0500
MIME-Version: 1.0
Content-Type: multipart/mixed;
boundary="----=_NextPart_000_0003_3FFD255D.7B19BB82"
X-Priority: 3
X-MSMail-Priority: Normal

===============================================================
Riyaz Sayyed                            E-mail  : support@...
Technical Support                       Voice   : +91-20-4017394 / 40173945

Cat computer Services (P) Ltd           Voice   : +91-20-4017396
603 Mayfair Tower II, Wakdewadi,        Fax     : +91-20-4025984
Mumbai-Pune Road, Pune 411 005.         http://www.quickheal.com

I N D I A '  S   L E A D I N G   A N T I V I R U S    S O F T W A R E
===============================================================
{Please leave original mail in place when replying}

------------------------------------------
Cat Computer Services Pvt Ltd, Pune, India