Many email messages that are detected as having a virus or junk mail (spam) are sent from different sources than the message displays. This technique, known as "spoofing" masks the true identity of where the message originated. Often times it is simply an infected computer and not an attack by a real person. You can uncover more accurately where the message originated by checking the Email Headers. Email Headers contain the "behind the scenes" communications that mail servers keep when passing email from one system to another. Below are some instructions for finding the Email Headers in some of the more common mail programs.
Microsoft Outlook
Locate the message in the list of messages in your Inbox.
Right-Click on the message and
select Options.
A new window will appear titled Message Options. The
Email Headers are listed in the box
at the bottom of the window titled Internet Headers.
The originating source for the message is listed after the text Received: from. This is the server that sent this message.
Outlook Express
Locate the message in the list of messages in your Inbox.
Right-Click on the message and
select Properties.
A new window will appear. Click the
Details tab at the top of the window. The Email Headers
are listed in the box.
The originating source for the message is listed after the text Received: from. This is the server that sent this message.
Other Mail Programs
Each mail program is a different. Nearly all have a way to view the Email Headers, but there are usually different methods for finding it. Below is a link to a website with many other mail programs. If your mail program is not shown above, you may find instructions at HaltAbuse.org.
Interpreting the Results
If you see numerous messages in a short period of time that look suspicious as containing a Virus or Spam, the headers of these messages will tell you which email server is to blame. You may receive numerous emails that appear to be from various senders - in a short period of time. Often there is only a single computer (virus-infected) that sent all of these. Viewing the headers on each of these emails should show you this single source. In many cases you can obtain an email address for a technical contact that runs the mail server by entering the server name you found in the Email Headers into a Whois search. You can then contact them directly or contact your Internet Service Provider (ISP) to report them as sending infected mail or spam messages.
