They come from random, non-existant addresses. That's part of the worm's disguise so you can't figure out where they're coming from.
Every once in a while I get one that says it's from
RATNLUV@msn.com, but he says his computer is clean. So it probably just someone out there that has RATNLUV in their address book. That's another thing the worm will do, pretend that it was sent by someone in your address book.
There's a little more information in the email header:
Quote:
Received: from [64.85.10.4] by mail-server
(ArGoSoft Mail Server Plus for WinNT/2000, Version 1.8 (1.8.2.5)); Sat, 15 Feb 2003 16:22:38 -0800
Received: from Hmjpdzqhw [65.60.152.123] by steelhead.securesupport.ws
(SMTPD32-7.07) id A9C6565006E; Sat, 15 Feb 2003 16:22:30 -0800
From: RATNLUV <RATNLUV@msn.com>
To:
ben@luvtruck.comSubject: Cellspacing
MIME-Version: 1.0
Content-Type: multipart/alternative;
boundary=NwG215r7618B1OC8g6Kt2wHaXPHdm
Message-Id: <20030215162260.SM01056@Hmjpdzqhw>
Date: Sat, 15 Feb 2003 16:22:42 -0800
I traced the origin IP number and it comes up as:
WideOpenWest LLC WIDEOPENWEST (NET-65-60-128-0-1)
65.60.128.0 - 65.60.255.255
WIDEOPENWEST MICHIGAN WOW-MICH-3-136 (NET-65-60-136-0-1)
65.60.136.0 - 65.60.159.255
WIDEOPENWEST.COM (WIDEOPENWEST-DOM)
900 W Castleton Rd
CASTLE ROCK, CO 80104
US
So, who lives in Michigan?