Internetworkers: http://www.ibiblio.org/internetworkers/

[Jason Laughlin <jason AT jasonlaughlin.com>]

This actually happened to me on a yahoogroup that I'm the admin for.  The 
list was set so that only I, as owner, could send messages to the 
list.  However, a subscriber's computer was infected with Klez.  The virus 
sent out an email with a forged "From:" field to the list.  Unfortunately, 
the Yahoogroups software only looked at the From: field to determine 
whether it was from me, and allowed the message to go through to my entire 
group.  Since no other fields were forged, it was a simple matter to 
identify the originating email account, but the email had been sent, and an 
hour later I had multiple messages from friends and servers mistakenly 
telling me that I had the Klez.

(To prevent problems in the future, I've changed the group settings to 
strip all attachments.)

Jason



At 10:04 AM 6/20/2002, you wrote:

> Are you sure is someone taking over your identity for spam pouropses?
>
> The Klez virus has a behavious that, first, made me think that someone hasd
> taken over my email address. Then, I learnt some more about Klez. Now I know
> that it was the Klez virus.
>
> How the Klez virus work?
>
> First, infects someone
>
> Then, checks for e-mail addresses in the addressbooks, cached-webpages, sent
> messages, received messages, newsgroup messages (if you are into usenet)...
>
> Now, the virus decides to use one of those collected email addresses as the
> forged "From" field, to make more difficult to detect the infected machine.
>
> The last step is the "reproduction": the virus sends itself to all the
> collected e-mail addresse, using the "From" (and, I think, "Retrun-To")
> field(s) forged so they point to someoneelses's adress.
>
> So, when an infected email bounces, it bounces to an uninfected, unsuspecting
> email address (the one used in the "From" field).
>
> Of course, using the "Sender-IP" field you can verify that it was not you who
> sent the email.
>
> With some triangulation, SamSpade and a few friends, I was able to get to one
> of my "Windows-friends" infected with the Klez viirus that was using my
> e-mail address in the "From:" field.
>
> Hope that this is your case.
>
>
>
> Salut,
> Josep
> --
> Josep L. Guallar-Esteve, QA-Test Engineer, Red Hat, Inc.
> http://www.ibiblio.org/sinner/
>
> ---
> Come and play at the InterNetWorkers Web 
> site!  http://www.ibiblio.org/internetworkers/
> You are currently subscribed to internetworkers as: jason AT jasonlaughlin.com
> To unsubscribe send a blank email to 
> $subst('Email.Unsub')