At 2:28 PM -0500 1/5/03, II Alan W. Rateliff wrote:
Klez sends itself out with a forged From: address using its own SMTP engine. From the headers, Phil doesn't appear to be the source of the virus, he's just a good samaritan keeping us information. Because of the way headers are managed by mailing lists, it's not possible now to determine the real source of the original post.
Well, the message did have these headers:
Received: from matt.powelljr.2y.net (65.35.12.210) by turing.pensive.org with ESMTP (Eudora Internet Mail Server 3.2b4) for <[EMAIL PROTECTED]>; Sun, 5 Jan 2003 05:42:13 -0800 Received: from Das (frankie [192.168.0.3]) by matt.powelljr.2y.net (8.11.6/8.11.6) with SMTP id h05EgLC71105 for <[EMAIL PROTECTED]>; Sun, 5 Jan 2003 09:42:21 -0500 (EST) (envelope-from [EMAIL PROTECTED])
