KLEZ virus Spoofing the FROM: address, namely your list, which is where the "bounce" (due to A/V detection) of mail was sent. At 09:57 01/13/2003 Monday, Frey, Kristen wrote: >I just received the following message in an error report. At first I >thought this was one of the subscribers to my list trying to POST, but I >can't explain the "[log in to unmask]" in the TO field. >Anyone know where something like this came from - or is anyone able to point >me to an archive of a related issues (my searching the archives produced >nothing relevant). >text of message in question: > >From: L-Soft list server at PEACH.EASE.LSOFT.COM (1.8e) >[[log in to unmask]] >Sent: Saturday, January 11, 2003 9:14 AM >To: [log in to unmask] >Subject: Rejected posting to [log in to unmask] > >Your posting to the GOURMET-ECLUB list has been rejected because it >contains >the 'Exploit.IFrame.FileDownload' virus. You are strongly advised to check >your >computer for viruses as soon as possible! > >----------------------- Rejected message (2171 lines) >------------------------- >Return-Path: <[log in to unmask]> >Received: from 204.127.131.116 by WALNUT.EASE.LSOFT.COM (SMTPL release 1.0i) >with TCP; Sat, 11 Jan 2003 09:13:59 -0500 >Received: from Dfuaaa ([12.91.244.227]) by mtiwmhc12.worldnet.att.net > (InterMail vM.5.01.05.12 201-253-122-126-112-20020820) with SMTP > id <20030111141323.KPXY12483.mtiwmhc12.worldnet.att.net@Dfuaaa> > for <[log in to unmask]>; > Sat, 11 Jan 2003 14:13:23 +0000 >From: NEWS-AT-UB-LIST <[log in to unmask]> >To: [log in to unmask]