It is more... usually the virus takes an address
from the Outlook address book (I wonder why this
program is still used by ANYONE) of a guy with an
infected system and then sends to certain people in the address book of this person an email where he
fakes it was not sent by the guy with the infected
system, but instead by the guy who was choosen
from the address-book. So usually the addresses
which would be blocked by the user who started
the thread would be people who do not have
any infected systems (but are in address books of
people with infected systems).
Even worse - after what I was told Sobig.f takes it's
addresses not only from the Outlook address book,
but also from Webcaches of popular browsers.
So if someone released a program with a readme
which was released on Aminet, and someone with
an infected system browses the HTML-Version of Aminet (and this readme) the virus could get his
email address and fake virus-mails with his email...
And the guy who'se email was faked even still gets
all the "Your email contained a virus" for hundreds
or thousands of mails he did not even send. Often he does not even use Windows (meaning Macro-Viri
cannot infect his system).
The good news: Sobig.f will selfdestruct on
9th September, appearently...
Steffen
