HEADERS?

From: Lawrence Walker <lgwalker_at_mts.net>
Date: Wed Jul 31 02:42:01 2002

 I've just had a flock(5) of them and they all had the same return line as yours.
I use Pegasus which does not automatically open HTML. I stupidly opened
the first one but checking with both the Symantec and Kaspersky Klez tools
say I'm clean. They all vary in size but average around 150k. 2 were
supposedly from list members but the other 3 were unknown to me.
 I guess it is harvesting Richards mail.

Lawrence

> > At 07:29 PM 7/30/2002 -0700, Fred Cisin (XenoSoft) wrote:
> > >Can somebody more familiar with such confirm whether that is indeed
> > >Richard Erlacher's machine that sent the following copy of Klez? (Headers
> > >only follow)
>
> On Tue, 30 Jul 2002, John Foust wrote:
> > One trick of Klez is that it harvests e-mail addresses
> > from your mailboxes and uses them to spoof the From: line,
> > in order to make it seem (on casual inspection) that
> > person has the virus. They don't. Someone who received
> > mail from Erlacher (perhaps a list subscriber) has Klez.
>
> NO. PLEASE look again. Dick's address is in the RETURN PATH line, NOT
> the FROM line! It appears that Dick's computer is the one with
> Klez, and it put a false FROM: of JPLCSCH_at_aol.com
>
> MOST varieties of Klez put a bogus FROM:, but leave the
> Return-Path: intact.
>
>
>
> Return-Path: <edick_at_idcomm.com>
> Received: from mailhost.idcomm.com (mailhost.idcomm.com [207.40.196.14])
> by lmi.net (8.8.8/8.8.7) with ESMTP id TAA05488
> for <cisin_at_xenosoft.com>; Tue, 30 Jul 2002 19:17:42 -0700 (PDT)
> Received: from Dqza (dsl-res156.idcomm.com [216.98.199.156])
> by mailhost.idcomm.com (8.10.2/8.10.0) with SMTP id g6V2HSJ01036
> for <cisin_at_xenosoft.com>; Tue, 30 Jul 2002 20:17:29 -0600
> Date: Tue, 30 Jul 2002 20:17:29 -0600
> Message-Id: <200207310217.g6V2HSJ01036_at_mailhost.idcomm.com>
> From: JPLCSCH <JPLCSCH_at_aol.com>
> To: cisin_at_xenosoft.com
> Subject: Dialog under
> MIME-Version: 1.0
> Content-Type: multipart/alternative;
> boundary=Q37LE02W0269aCiF037Kl967jS3g6
>
>


lgwalker_at_mts.net
bigwalk_ca_at_yahoo.com
Received on Wed Jul 31 2002 - 02:42:01 BST