KLEZ virus Spoofing the FROM: address, namely your list, which is where
the "bounce" (due to A/V detection) of mail was sent.


At 09:57 01/13/2003 Monday, Frey, Kristen wrote:
 >I just received the following message in an error report.  At first I
 >thought this was one of the subscribers to my list trying to POST, but I
 >can't explain the "[log in to unmask]" in the TO field.
 >Anyone know where something like this came from - or is anyone able to point
 >me to an archive of a related issues (my searching the archives produced
 >nothing relevant).
 >text of message in question:
 >
 >From: L-Soft list server at PEACH.EASE.LSOFT.COM (1.8e)
 >[[log in to unmask]]
 >Sent: Saturday, January 11, 2003 9:14 AM
 >To: [log in to unmask]
 >Subject: Rejected posting to [log in to unmask]
 >
 >Your posting  to the GOURMET-ECLUB list  has been rejected because  it
 >contains
 >the 'Exploit.IFrame.FileDownload' virus. You are strongly advised to check
 >your
 >computer for viruses as soon as possible!
 >
 >----------------------- Rejected message (2171 lines)
 >-------------------------
 >Return-Path: <[log in to unmask]>
 >Received: from 204.127.131.116 by WALNUT.EASE.LSOFT.COM (SMTPL release 1.0i)
 >with TCP; Sat, 11 Jan 2003 09:13:59 -0500
 >Received: from Dfuaaa ([12.91.244.227]) by mtiwmhc12.worldnet.att.net
 >          (InterMail vM.5.01.05.12 201-253-122-126-112-20020820) with SMTP
 >          id <20030111141323.KPXY12483.mtiwmhc12.worldnet.att.net@Dfuaaa>
 >          for <[log in to unmask]>;
 >          Sat, 11 Jan 2003 14:13:23 +0000
 >From: NEWS-AT-UB-LIST <[log in to unmask]>
 >To: [log in to unmask]