From listadm Wed May 1 12:06:09 2002 Received: from siaag2ae.compuserve.com (siaag2ae.compuserve.com [149.174.40.135]) by dkuug.dk (8.9.2/8.9.2) with ESMTP id MAA56482 for ; Wed, 1 May 2002 12:06:09 +0200 (CEST) (envelope-from 100434.3031@compuserve.com) Received: (from mailgate@localhost) by siaag2ae.compuserve.com (8.9.3/8.9.3/SUN-1.12) id GAA09155 for SC24@dkuug.dk; Wed, 1 May 2002 06:05:40 -0400 (EDT) Date: Wed, 1 May 2002 06:05:11 -0400 From: jean stride <100434.3031@compuserve.com> Subject: WARNING : POSSIBLE VIRUS ON SC 24 MAILS Sender: jean stride <100434.3031@compuserve.com> To: ISO/IEC JTC 1/SC 24 Message-ID: <200205010605_MC3-FC2E-83ED@compuserve.com> MIME-Version: 1.0 Content-Type: text/plain; charset=ISO-8859-1 Content-Disposition: inline Content-Transfer-Encoding: 8bit X-MIME-Autoconverted: from quoted-printable to 8bit by dkuug.dk id MAA56483 Hello, Steve Carson has warned me that a spoof SC 24 message containing a virus has been sent to him - please be aware of this. See message below Jean ************* This worm (Klez) has the ability to spoof the From: field (often set to an address found on the victim machine). So I can't tell if this mail went to everyone on the reflector or just to me. Are either you or Laura getting these messages? If not, then it is probably a spoofed address. Here is a page with more data on it: http://vil.nai.com/vil/content/v_99455.htm It is possible that it has just infected someone's machine who has the SC 24 reflector address and mine both in their address book. It might be worth a message to the reflector warning people that someone's machine with the SC 24 reflector address in their address book has been infected and the virus is attempting to spread by spoofing the From field to make it appear that messages come from the SC 24 reflector. ---------------------------------------------------------