Re: Virus???

[Rick Stevens <rstevens vitalstream com>]

Al Gelders wrote:
> For the last couple of weeks my email account has been deluged with mail
> bounces from people I've never heard of.  The headers all state that the
> original email was from my email address but there is a different name
> associated with each.  Most have a subject like "hi jim, how is
> college?" or the like (i.e. John Doe <agelders lightspeed net>). On a
> typical weekday I'll receive 20 to 50 bounced emails that all claim me
> as the originator.
>
> I thought I had a pretty well firewalled machine that I keep current. 
> Is there any possibility that it has been taken over and I'm either
> spamming people or sending out a virus?  If it is me, where do I look to
> clean it up?  BTW, I do have a Win2K machine on my local network but it
> doesn't even have email enabled. Thanks.

Someone twit with Windows that has you in their Outlook database has
been infected with the Klez virus.  They're sending out mail with the
"From" address forged to look like you.  When the message bounces, it
will bounce to you, since you are listed in the "From" header (either
envelope or message).

Check the size of the bounced message.  Klez-infected messages will have
an attachment that's on the order of 125K in size.  The subject of the
messages and the name of the attachment will vary.
----------------------------------------------------------------------
- Rick Stevens, Senior Systems Engineer     rstevens vitalstream com -
- VitalStream, Inc.                       http://www.vitalstream.com -
-                                                                    -
-         Microsoft Windows:  Proof that P.T. Barnum was right       -
----------------------------------------------------------------------