Here is an excerpt from the symantec site talking about the subject line and
from address. I have received this virus from three different sources today
alone so it is making its rounds.
The email message that this worms sends is composed of "random" strings. The
subject can be one of the following:
Undeliverable mail--"[Random word]"
Returned mail--"[Random word]"
a [Random word] [Random word] game
a [Random word] [Random word] tool
a [Random word] [Random word] website
a [Random word] [Random word] patch
[Random word] removal tools
how are you
let's be friends
darling
so cool a flash,enjoy it
your password
honey
some questions
please try again
welcome to my hometown
the Garden of Eden
introduction on ADSL
meeting notice
questionnaire
congratulations
sos!
japanese girl VS playboy
look,my beautiful girl friend
eager to see you
spice girls' vocal concert
japanese lass' sexy pictures
The random word will be one of the following:
new
funny
nice
humour
excite
good
powful
WinXP
IE 6.0
W32.Elkern
W32.Klez.E
Symantec
Mcafee
F-Secure
Sophos
Trendmicro
Kaspersky
The body of the email message is random.
NOTES:
Because this worm uses a randomly chosen address that it finds on an infected
computer as the "From:" address, numerous cases have been reported in which
users of uninfected computers received complaints that they sent an infected
message to someone else.
For example, Linda Anderson is using a computer that is infected with
W32.Klez.H@mm. Linda is not using a antivirus program or does not have
current virus definitions. When W32.Klez.H@mm performs its emailing routine,
it finds the email address of Harold Logan. It inserts Harold's email address
into the "From:" portion of an infected message that it then sends to Janet
Bishop. Janet then contacts Harold and complains that he sent her an infected
message, but when Harold scans his computer, Norton AntiVirus does not find
anything--as would be expected--because his computer is not infected.
Hope this helps and you all catch it before it executes like I did.
Norton catches it quite well but if you get infected they have a tool on
their site to attempt to clean up your computer.
Dave
CastleMyst Cavaliers
http://members.aol.com/CMystCavs
=========================================================
"Magic Commands":
to stop receiving mail for awhile, click here and send the email:
mailto:[EMAIL PROTECTED]?body=SET%20CKCS-L%20NOMAIL
to start it up gain click here:
mailto:[EMAIL PROTECTED]?body=SET%20CKCS-L%20MAIL
E-mail [EMAIL PROTECTED] for assistance.
Search the Archives... http://apple.ease.lsoft.com/archives/ckcs-l.html
All e-mail sent through CKCS-L is Copyright 2002 by its original author.
