[rescue] Re: Strange "DownloadsAllUpInYerFace()" message.. Klez

Leslie Connally lesliec at theplanet.com
Sat May 4 14:12:17 CDT 2002


> Its that damn klez virus, or a variant - it didnt actually come from my
> machine.  Look at this header:
>
> Notice no "ohno.mrbill.net" in there.  Someone's spoofing from: headers.
>

I just spent the week helping (god-protect-the-clueless) Windows users from
the Klez worm.. The worm takes addresses from address books and uses them
as spoofed "From:" headers

so yes.. the full headers tell all.

Les



More information about the rescue mailing list