Here's a good example Jeff:
Email came into my mailbox from "Network Associates" (virus removed by
Norton before it touched the PC)...look at the return path though.
Return-Path: <decoposh@netzero.net>
Received: from mail7.wlv.netzero.net (mail7.wlv.netzero.net
[209.247.163.57])
by mail1.aus1.texas.net (8.11.6/8.11.6) with SMTP id
g813vg910310
for <bernd@texas.net>; Sat, 31 Aug 2002 22:57:42 -0500 (CDT)
Date: Sat, 31 Aug 2002 22:57:42 -0500 (CDT)
Message-Id: <200209010357.g813vg910310@mail1.aus1.texas.net>
Received: (qmail 5800 invoked from network); 1 Sep 2002 03:57:15 -0000
Received: from 1cust86.tnt1.pensacola.fl.da.uu.net (HELO Iijviyu)
(67.210.254.86)
by mail7.wlv.netzero.net with SMTP; 1 Sep 2002 03:57:15 -0000
From: support <support@nai.com>
To: bernd@texas.net
Subject: Please try again
MIME-Version: 1.0
Content-Type: multipart/alternative;
boundary=Wp5ZU3ZzmuZB0zDo3iSvHr6T389Z992
X-UIDL: ?=I!!~S4!!@Rg!!2MM"!
- Bernd
-----Original Message-----
From: owner-dakota-truck@dakota-truck.net
[mailto:owner-dakota-truck@dakota-truck.net] On Behalf Of crm
Sent: Saturday, August 31, 2002 8:30 AM
To: dakota-truck@dakota-truck.net
Subject: DML: Re: RE: Virus
jeff, look at the full header of the message to determine where it
really came from.
-adam
----- Original Message -----
From: "Bernd D. Ratsch" <bernd@texas.net>
To: <dakota-truck@dakota-truck.net>
Sent: Saturday, August 31, 2002 10:01 AM
Subject: DML: RE: Virus
This archive was generated by hypermail 2b29 : Fri Jun 20 2003 - 12:05:19 EDT