Since I asked the question I will provide the answer (I wasn't asking about
the original source, the author, just figuring out the infected computer,
the "source" for purposes of my question).

In my question I did not say what I already knew, nor what I suspected, as
I did not want to influence replies.  I already knew that 67.115.115.116
was a Pacific Bell number and suspected that that number was leased to
San Francisco Public Library, but could not confirm the suspicion with any
of my available diagnostics.  I now have confirmation (after eight or so
hours trying to get someone to reply) from folk at SFPL.ORG that my
suspicion was correct (also confirmation of a minor suspicion that no one
there knew there was a problem).  The infection was eliminated an hour or
two ago, subsequent to my postings to them.

That CAT-STAFF-M71 is, as suspected, an internal code (made sense to me:
"CATaloging-STAFF-M71", the M71 being the individual's code).  Neither M71
(I do know the preson's name) nor computing support at SFPL were aware of
any problem.  M71's PC has now been cleansed of the SoBig virus, so there
shouldn't be any further problem (grain of salt, keeping in mind somewhat
similar problems at SFPL in the past).

Douglas Winship
[log in to unmask]