[Req #26455] Re: Undeliverable mail--"The Mustang Back Support With Suspenders, 728, "

Subject: [Req #26455] Re: Undeliverable mail--"The Mustang Back Support With Suspenders, 728, "
From: Mitchell Wand (wand@ccs.neu.edu)
Date: Tue Jun 11 2002 - 14:24:14 EDT

I don't think these messages are from somebody on dem. It is more
likely that someone with an infected machine has dem in their address

Here's my copy of the message in question, with headers intact. Note
that the From: line has also been forged, so that the message appears
to be from the recipient's postmaster.

The forged From: is characteristic of the Klez virus. Earlier
versions simply supplied a From: address from the infectee's address
book. The forged From:=postmaster is a new variation that has shown
up just in the last week or so.

See also my Req's 26422 and 26448.


 From catco@emirates.net.ae Tue Jun 11 10:10:50 2002
 Return-Path: <catco@emirates.net.ae>
 Delivered-To: wand@amber.ccs.neu.edu
 Received: by amber.ccs.neu.edu (Postfix)
         id 1F25C1AA10; Tue, 11 Jun 2002 10:10:16 -0400 (EDT)
 Delivered-To: dem@ccs.neu.edu
 Received: from domail1 (unknown [])
         by amber.ccs.neu.edu (Postfix) with ESMTP id B19A61AAA1
         for <dem@ccs.neu.edu>; Tue, 11 Jun 2002 10:10:11 -0400 (EDT)
 Received: from pmail.emirates.net.ae (pmail.emirates.net.ae [])
  by domail1.emirates.net.ae
  (iPlanet Messaging Server 5.2 HotFix 0.2 (built Apr 26 2002))
  with ESMTP id <0GXJ00D3DNVLM5@domail1.emirates.net.ae> for dem@ccs.neu.edu;
  Tue, 11 Jun 2002 17:52:34 +0400 (GST)
 Received: from Grzgnoiev (lda145.emirates.net.ae [])
  by pmail.emirates.net.ae
  (Sun Internet Mail Server sims.4.0.2000.
  with SMTP id <0GXJ00J2XNUF4U@pmail.emirates.net.ae> for dem@ccs.neu.edu; Tue,
  11 Jun 2002 17:52:16 +0400 (GST)
 Date-warning: Date header was inserted by pmail.emirates.net.ae
 Message-id: <0GXJ00J2YNUF4U@pmail.emirates.net.ae>
 MIME-version: 1.0
 Content-type: multipart/alternative;
 From: postmaster <postmaster@ccs.neu.edu>
 To: dem@ccs.neu.edu
 Subject: Undeliverable mail--"The Mustang Back Support With Suspenders, 728, "
 Date: Tue, 11 Jun 2002 17:52:16 +0400 (GST)

 Content-type: text/html
 Content-transfer-encoding: 7BIT


 <FONT>The following mail can't be sent to bIbxfrrbuit@ao.o:<br>
 From: dem@ccs.neu.edu<br>
 To: bIbxfrrbuit@ao.o<br>
 Subject: The Mustang Back Support With Suspenders, 728, <br>
 The file is the original mail</FONT></BODY></HTML>

 Content-id: <QJuiLUj1FZ1CX2e>
 Content-type: application/octet-stream; name=Vshng.exe
 Content-transfer-encoding: base64
 Content-disposition: attachment; filename=Vshng.exe



This archive was generated by hypermail 2b28 : Tue Jun 11 2002 - 14:24:25 EDT