[832] in winnt
Re: more W32/Klex.eml e-mails :(
daemon@ATHENA.MIT.EDU (Dave Broderick)
Thu May 2 09:05:45 2002
Message-Id: <5.0.2.1.2.20020502090418.02611f00@hesiod>
Date: Thu, 02 May 2002 09:05:42 -0400
To: "Huxley, Bil" <huxley@mit.edu>, security-fyi@mit.edu,
mitvirus@mitvma.mit.edu
From: Dave Broderick <djbroder@MIT.EDU>
Cc: itpartners@mit.edu, winpartners@mit.edu
In-Reply-To: <5.0.2.1.2.20020502080234.03026fe8@po9.mit.edu>
Mime-Version: 1.0
Content-Type: multipart/alternative;
boundary="=====================_84400218==_.ALT"
--=====================_84400218==_.ALT
Content-Type: text/plain; charset="us-ascii"; format=flowed
As I understand it, this virus may be able to spoof email addresses, so the
*apparent* sender might not even be *guilty*, or even a real person.
At 08:22 AM 5/2/2002 -0400, Huxley, Bil wrote:
>Good Morning,
>
>Around midnight last night two more W32/Klez.eml e-mails were sent to MIT
>mailing lists (that I'm on - perhaps more...). One with a subject of
>"Byte.careercast.com" was sent to itpartners at 12:04:25 and one with a
>subject of "Honey" was sent to winpartners at 12:07:03. Both times are
>from the receipt at MIT in the e-mail headers.
>
>These both appear to have been received via Tether (18.162.2.177). Might
>it be possible to contact to Tether User and see if they have an infected
>machine that they were not aware of?
>
>Please let me know if there's any way I might help eradicate this worm
>from our community.
>
>FYI,
> Bil
David J. Broderick
djbroder@mit.edu
Senior Audio Visual Specialist
MIT AV 617 253 2808
FAX 617 253 5945
<http://web.mit.edu/djbroder/www>http://web.mit.edu/djbroder/www
--=====================_84400218==_.ALT
Content-Type: text/html; charset="us-ascii"
<html>
As I understand it, this virus may be able to spoof email addresses, so
the *apparent* sender might not even be *guilty*, or even a real
person.<br>
<br>
At 08:22 AM 5/2/2002 -0400, Huxley, Bil wrote:<br>
<blockquote type=cite class=cite cite>Good Morning,<br>
<br>
Around midnight last night two more W32/Klez.eml e-mails were sent to MIT
mailing lists (that I'm on - perhaps more...). One with a subject
of "Byte.careercast.com" was sent to itpartners at 12:04:25 and
one with a subject of "Honey" was sent to winpartners at
12:07:03. Both times are from the receipt at MIT in the e-mail
headers.<br>
<br>
These both appear to have been received via Tether (18.162.2.177).
Might it be possible to contact to Tether User and see if they have an
infected machine that they were not aware of?<br>
<br>
Please let me know if there's any way I might help eradicate this worm
from our community.<br>
<br>
FYI,<br>
Bil<br>
</blockquote>
<x-sigsep><p></x-sigsep>
<br>
David J. Broderick <br>
<font color="#0000FF"><b>djbroder@mit.edu <br>
</b></font><x-tab> </x-tab>Senior
Audio Visual Specialist <br>
<x-tab> </x-tab>MIT AV 617
<b>253 2808 <br>
</b><x-tab> </x-tab>FAX
617 253 5945 <br>
<x-tab> </x-tab><a href="http://web.mit.edu/djbroder/www">http://web.mit.edu/djbroder/www</a>
<br>
</html>
--=====================_84400218==_.ALT--
