[off topic really, but I didn't start the thread!] Klez has its own builtin SMTP client code and fakes the sender address from any email address it can find in files on the local machine (web cache, address book, etc.), so it's probably *not* WXW's machine that's sending the virus-infected mail. Not much you can do about this except install a virus scanner on your mail server to block the messages, or examine the headers and complain to the sender's ISP.
Mark. On 2002-05-24 (Friday) at 02:32:48 -0700, Mark Petersen wrote: > <sarcasm> > Gee...Sorry for the *huge* inconvenience Paul. > </sarcasm> > Just trying to get a message through to William, and I have no idea what > email address he uses now since he's switched everything over > (as far as I know) to his new domain. What I DO know, is that he watches > THIS list. > Why? Do you have a problem with that? > Oh, and BTW, no, I'm not planning on doing that. Unless you'd like me to. > > ----- Original Message ----- > From: "Paul Chvostek" <[EMAIL PROTECTED]> > To: <[EMAIL PROTECTED]> > Sent: Friday, May 24, 2002 1:55 AM > Subject: Re: Virus Aleart For William X Walsh > > > > > > On Fri, May 24, 2002 at 12:50:11AM -0700, Mark Petersen wrote: > > > > > > Hi William, > > > One of my hosting clients just emailed me and said that he received a > rather strange email from [EMAIL PROTECTED] > > > When he previewed it "did something" he said. Apparently the body of the > message was blank, but it had an attachment > > > (he didn't look to see what it was), and the subject line "Cellpadding". > I advised him to run a scan right away. The scan > > > turned up finding the Klez virus. It appears that the email he received > from you (or masqueraded as being you) may have been > > > the payload vehicle. You may want to check out your systems just to be > safe. > > > > Why are you announceing this to the OpenSRS discuss-list? > > > > Are you also planning to notify the subscribers of the isp-* lists, > > and maybe inet-access? > > > > > > -- > > Paul Chvostek <[EMAIL PROTECTED]> > > Operations / Development / Abuse / Whatever vox: +1 416 598-0000 > > it.canada http://www.it.ca/ > > >
