Wed, 15 Jan 2003 09:36:08 -0500
|
KLEZ virus Spoofing the FROM: address, namely your list, which is where
the "bounce" (due to A/V detection) of mail was sent.
At 09:57 01/13/2003 Monday, Frey, Kristen wrote:
>I just received the following message in an error report. At first I
>thought this was one of the subscribers to my list trying to POST, but I
>can't explain the "[log in to unmask]" in the TO field.
>Anyone know where something like this came from - or is anyone able to point
>me to an archive of a related issues (my searching the archives produced
>nothing relevant).
>text of message in question:
>
>From: L-Soft list server at PEACH.EASE.LSOFT.COM (1.8e)
>[[log in to unmask]]
>Sent: Saturday, January 11, 2003 9:14 AM
>To: [log in to unmask]
>Subject: Rejected posting to [log in to unmask]
>
>Your posting to the GOURMET-ECLUB list has been rejected because it
>contains
>the 'Exploit.IFrame.FileDownload' virus. You are strongly advised to check
>your
>computer for viruses as soon as possible!
>
>----------------------- Rejected message (2171 lines)
>-------------------------
>Return-Path: <[log in to unmask]>
>Received: from 204.127.131.116 by WALNUT.EASE.LSOFT.COM (SMTPL release 1.0i)
>with TCP; Sat, 11 Jan 2003 09:13:59 -0500
>Received: from Dfuaaa ([12.91.244.227]) by mtiwmhc12.worldnet.att.net
> (InterMail vM.5.01.05.12 201-253-122-126-112-20020820) with SMTP
> id <20030111141323.KPXY12483.mtiwmhc12.worldnet.att.net@Dfuaaa>
> for <[log in to unmask]>;
> Sat, 11 Jan 2003 14:13:23 +0000
>From: NEWS-AT-UB-LIST <[log in to unmask]>
>To: [log in to unmask]
|
|
|