Subject: Re: Let's be friends

From: Bret Busby <[email-masked]>
Date: Tue, 30 Apr 2002 14:17:30 +0800 (WST)

I have received a message from a genealogy list to which I subscribe, that
indicates that the messages below, are viral messages, indicating that the
mailing list server appears to have been infected by the
"I-worm/klez.h" virus, as it was named by the genealogy mailing list
administrator.

Can the mailing list administrator for the PINE discussion mailing list,
please clarify whether the mailing list server has in fact been infected
with a virus, and, if so, what operating system the mailing list server is
running, as this is a matter of concern.

If requested, by the mailing list administrator, I can forward the full
headers, to the mailing list administrator.

Thank you in anticipation.

-- 
Bret Busby
Armadale
West Australia
..............

"So once you do know what the question actually is, 
 you'll know what the answer means."
 - Deep Thought, 
   Chapter 28 of The Hitchhiker's Guide to the Galaxy
 - Douglas Adams, 1988
.......................................
On Mon, 29 Apr 2002, owner-pine-info wrote:
> 
> Date: Mon, 29 Apr 2002 22:17:42 -0500 (CDT)
> From: owner-pine-info <[email-masked]>
> To: Pine Discussion Forum <[email-masked]>
> Subject: Let's be friends
> 
> 
>     [ Note: This message contains email list management information ]
> 
..............................................................
On Mon, 29 Apr 2002, owner-pine-info wrote:
> 
> Date: Mon, 29 Apr 2002 10:18:25 -0400 (EDT)
> From: owner-pine-info <[email-masked]>
> To: Pine Discussion Forum <[email-masked]>
> Subject: The Garden of Eden
> 
> 
>     [ Note: This message contains email list management information ]
> 
..............................................................

---

From: Jo Knox <[email-masked]>
Date: Tue, 30 Apr 2002 10:54:15 -0800 (AKDT)

> Thank you in anticipation.

Bret,

Actually, the mailing list server is fine, and is not likely to be prone
to infection (it's probably not even a windows machine!)  This message was
originally a mailing from the Klez worm, which forges its return address
before sending itself.  The return address it chooses randomly from those
found in mail on the local Windows computer.  It appears the Pine mailing
list software didn't forward the attachments (good!)  Checking the
received headers (Pine's 'h' command in the message view toggles Header
Full View), you'll see the message originally came from:

Received: from tim.281.com (ken.281.com [209.84.39.6])
        by mx1.cac.washington.edu (8.12.1+UW01.12/8.12.1+UW02.01) with ESMTP id g3U398Ps009015
        for <[email-masked]>; Mon, 29 Apr 2002 20:09:08 -0700
Received: from Djxxyxbk (dudcs5-235.281.com [216.202.202.235])
        by tim.281.com (8.11.6/8.11.6) with SMTP id g3U3HgE31311
        for <[email-masked]>; Mon, 29 Apr 2002 22:17:42 -0500 (CDT)
        (envelope-from [email-masked])

So I've alerted [email-masked] that they have an infected computer
which was dudcs5-235.281.com at Mon, 29 Apr 2002 22:17:42 -0500 (CDT)...
(The time is worth mentioning in case of ip addresses which change, such
as with DHCP or dialups!)

That's my opinion, anyway!
jo