Baslinux mailing list

[Sindi Keesan <keesan AT iamjlamb.com>]

If you look at the last Received line before the forged From line you will 
see that this differs from the Received line on other messages from 
Steven, which are from zimage and received by his ISP in New Zealand.

This worm appears to have been sent by [192.168.0.71] and received by the 
ISP web01-nyc.clicvu.com, which could be the address of a list member who 
is not currently active.  

---------- Forwarded message ----------
Return-Path: <baslinux-bounces AT lists.ibiblio.org>
Received: from happyhouse.metalab.unc.edu (happyhouse.metalab.unc.edu
    [152.2.210.119])
        by foxxy.triohost.com (8.12.8/8.12.8) with ESMTP id i3TFi1G0030822
        for <keesan AT iamjlamb.com>; Thu, 29 Apr 2004 11:44:01 -0400
Received: from happyhouse.metalab.unc.edu (localhost [127.0.0.1])
        by happyhouse.metalab.unc.edu (Postfix) with ESMTP
        id B3E5E200CE; Thu, 29 Apr 2004 11:43:52 -0400 (EDT)
Delivered-To: baslinux AT lists.ibiblio.org
Received: from web01-nyc.clicvu.com (web01-nyc.clicvu.com [209.10.150.71])
        by happyhouse.metalab.unc.edu (Postfix) with ESMTP id 63E28200CC
        for <baslinux AT lists.ibiblio.org>; Thu, 29 Apr 2004 11:43:35 -0400 
(EDT)
Received: from [192.168.0.71] by web01-nyc.clicvu.com
        (Post.Office MTA v3.5.3 release 223 ID# 0-64039U1000L100S0V35)
        with SMTP id com for <baslinux AT lists.ibiblio.org>;
        Thu, 29 Apr 2004 11:42:00 -0400
From: 3aoo-cvfd AT dea.spamcon.org
To: baslinux AT lists.ibiblio.org
....... [I deleted the rest of the full header]

Thank you for your request, your details are attached!