>We have had incidents of our postmaster account being the spoofed address
>that is used.
>
>Does anyone have any ideas how Klez is doing this?
Klez sometimes makes up addresses, by combining a known username with a
known hosthame. So if you have "[EMAIL PROTECTED]" and
"[EMAIL PROTECTED]" in your address book, it could send to
"[EMAIL PROTECTED]".
It also gets addresses from the web cache, so if someone was recently at a
page with "[EMAIL PROTECTED]", you could see Klez sending E-mail from
"[EMAIL PROTECTED]".
-Scott
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
This E-mail came from the Declude.Virus mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.Virus". You can E-mail
[EMAIL PROTECTED] for assistance. You can visit our web
site at http://www.declude.com .
