Open the message and look at the headers... You'll find the IP and domain name information in there.
Cheers, Tony -----Original Message----- From: Dustin Krysak [mailto:[EMAIL PROTECTED]] Sent: Tuesday, July 16, 2002 3:50 PM To: NT 2000 Discussions Subject: RE: Klez hmmm - I wonder how I can find out who it is coming from? He is getting all the alerts that he sent the email.... Dustin -----Original Message----- From: Wes Owen [mailto:[EMAIL PROTECTED]] Sent: Tuesday, July 16, 2002 10:50 AM To: NT 2000 Discussions Subject: RE: Klez This virus spoofs the sender it is most likely not actually coming from him. -----Original Message----- From: Woods, Tony MHR:EX [mailto:[EMAIL PROTECTED]] Sent: Tuesday, July 16, 2002 12:18 PM To: NT 2000 Discussions Subject: RE: Klez Sometimes for fun... Fdisk /mbr Cheers, Tony -----Original Message----- From: W2K Discussions [mailto:[EMAIL PROTECTED]] Sent: Tuesday, July 16, 2002 10:17 AM To: NT 2000 Discussions Subject: Klez Hi there... I had a user infected with the KLEZ worm.... And I have since rebuilt his machine.... (format, and reload), yet scan mail has picked up an instance of his machine apparently sending an email with this.... Is there something else I should have done to repair the machine? It is running AV with all the latest patches.... Ideas? Dustin ------ You are subscribed as [EMAIL PROTECTED] Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe send a blank email to %%email.unsub%% ------ You are subscribed as [EMAIL PROTECTED] Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe send a blank email to %%email.unsub%% This e-mail and any files transmitted with it are confidential and are intended solely for the use of the individual or entity to whom they are addressed. If you are NOT the intended recipient or the person responsible for delivering the e-mail to the intended recipient, be advised that you have received this e-mail in error and that any use, dissemination, forwarding, printing, or copying of this e-mail is strictly prohibited. ------ You are subscribed as [EMAIL PROTECTED] Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe send a blank email to %%email.unsub%% ------ You are subscribed as [EMAIL PROTECTED] Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe send a blank email to %%email.unsub%% ------ You are subscribed as [email protected] Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe send a blank email to [EMAIL PROTECTED]
