The Klez worm fakes its from address. Try checking the offending message's header to see whom it is actually from.
Things are not always simple. A short time ago, I was asked if I had a virus as someone was receiving multiple copies of mail I sent to either this list or lazydba. I made the usual protestations of living a good life and having "protected" mail. The person replied they received six copies of my denial. That same day maintenance was being done and our mail gateway was temporarily closed. I received a message saying an outgoing mail message was blocked by this closure; the one saying, "No way is it I." Before I apologized, many times over :), I queried our postmaster about the problem. She explained that the site which was receiving multiple copies was running a mail program with a bug. The bug kept the system from sending an acknowledgement of receipt to our system. Having received no receipt, our system was resending the message over and over again. She contacted their postmaster and I trust all is well. Ian MacGregor Stanford Linear Accelerator Center [EMAIL PROTECTED] -----Original Message----- Sent: Monday, November 25, 2002 12:04 PM To: Multiple recipients of list ORACLE-L Martin Kendall wrote: > > My Norton Antivirus reports that Stephane's email re. "How to pass > value from SQL*Plus to Unix scripts?" contains the W32.Klez.H@mm virus > in an "item" called stars-bkgrd. > > Anyone else had same alert ? > > Martin > > ------------------------------------------------------------------------ > Name: smime.p7s > smime.p7s Type: PKCS7 Signature (application/x-pkcs7-signature) > Encoding: 7bit Sorry for the trouble, folks, but I have trouble understanding. When I am answering the list, it is either from a Linux machine (and netscape) - not infected by W32.Klez.H@mm according to the Symantec site - or from a mail web interface. I sent the e-mail mentioned above on October 22nd or October 23rd (two answers to the same question) more than one month ago, and from Linux. I hope that somebody is not harvesting the list ... If anybody has any hint about how to check for viruses on a Linux machine, BTW ... -- Regards, Stephane Faroult Oriole Software -- Please see the official ORACLE-L FAQ: http://www.orafaq.com -- Author: Stephane Faroult INET: [EMAIL PROTECTED] Fat City Network Services -- 858-538-5051 http://www.fatcity.com San Diego, California -- Mailing list and web hosting services --------------------------------------------------------------------- To REMOVE yourself from this mailing list, send an E-Mail message to: [EMAIL PROTECTED] (note EXACT spelling of 'ListGuru') and in the message BODY, include a line containing: UNSUB ORACLE-L (or the name of mailing list you want to be removed from). You may also send the HELP command for other information (like subscribing). -- Please see the official ORACLE-L FAQ: http://www.orafaq.com -- Author: MacGregor, Ian A. INET: [EMAIL PROTECTED] Fat City Network Services -- 858-538-5051 http://www.fatcity.com San Diego, California -- Mailing list and web hosting services --------------------------------------------------------------------- To REMOVE yourself from this mailing list, send an E-Mail message to: [EMAIL PROTECTED] (note EXACT spelling of 'ListGuru') and in the message BODY, include a line containing: UNSUB ORACLE-L (or the name of mailing list you want to be removed from). You may also send the HELP command for other information (like subscribing).
