I don't claim to know much about mime headers, but I think I'm learning.

I suspect the KLEZ virus works like this:
You use outlook and get infected with klez. The virus randomly sends a
mail to someone in your address book, but makes it look like the email
came from someone else in your address book.

What this means to me is: I get a message from my mail server saying that
the message I sent could not be delivered. I never actually sent the
message that it claims I did. The infected person sent it with my address
as the return address.

Digging through the headers, I found that some of these seem to be coming
from someone using a dialup connection from the university of Pittsburg.
More recently, from AOL (what a surprise). I have been collecting headers
(unfortunately, my list is at home now) and have been intending to notify
an administrator. I would only hope that they would be willing to track
down the offending infected user.




On Thu, 15 Aug 2002, Jennifer L. Gatza wrote:

> They're Klez variants.  A *properly patched* version of Outlook will
> automatically strip all executable code (I had to check just to make sure)
> :)  A good real-time A/V program with updated signatures should take care of
> whatever gets through.
>
> I have received countless emails of this nature over the past month or two.
> The messages seem to extract keywords from the websites I maintain, then
> e-mail them to me in the subject line at the webmaster@ address at the
> bottom of each page.
>
> Not much you can do to stop the messages from coming, but I'm sure everyone
> on the PIClist that has to use Outlook makes sure they regularly check
> http://office.microsoft.com/productupdates, right?  ;)
>
> Jen, a.k.a. an obsessive security-conscious geek
>
> --
> http://www.piclist.com hint: PICList Posts must start with ONE topic:
> [PIC]:,[SX]:,[AVR]: ->uP ONLY! [EE]:,[OT]: ->Other [BUY]:,[AD]: ->Ads
>
>

--
http://www.piclist.com hint: PICList Posts must start with ONE topic:
[PIC]:,[SX]:,[AVR]: ->uP ONLY! [EE]:,[OT]: ->Other [BUY]:,[AD]: ->Ads