Subject: RE: A funny website - VIRUS

From: "Ray Stevens" <[email-masked]>
Date: Tue, 23 Apr 2002 09:51:24 -0400

Email received with virus
Recevied from : [email-masked]

The email attachment FOR.bat is infected with the W32.Klez.gen@mm virus.

W32.Klez.gen@mm is a generic detection that detects variants of W32.Klez.
Computers that are infected with W32.Klez.gen@mm are most likely infected
with either W32.Klez.E@mm or W32.Klez.H@mm. Please refer to the appropriate
write-ups for more information.

Removal tool
Symantec has provided a tool to remove infections of W32.Klez.E@mm,
W32.Klez.H@mm, W32.ElKern.3587, and W32.ElKern.4926. If your computer is
detected as infected with W32.Klez.gen@mm, download and run the tool. In
most case, to tool will be able to remove the infection. Click here to
obtain the tool.
http://securityresponse.symantec.com/avcenter/venc/data/w32.klez.removal.too
l.html

This is the easiest way to remove these threats and should be tried first.

Type: Virus, Worm
Infection Length: Varies

Ray Stevens
CCNP, CCDP, SCSA

--------------------------------------------------------------------
IETF IPng Working Group Mailing List
IPng Home Page:                      http://playground.sun.com/ipng
FTP archive:                      ftp://playground.sun.com/pub/ipng
Direct all administrative requests to [email-masked]
--------------------------------------------------------------------

---

From: "Jeroen Massar" <[email-masked]>
Date: Tue, 23 Apr 2002 16:27:51 +0200

> Recevied from : [email-masked]

And if you looked a bit further than your nose:
8<---------------------
<SNIP>
Received: from engmail4.Eng.Sun.COM (engmail4 [129.144.134.6])
	by sunroof.eng.sun.com (8.12.3+Sun/8.12.3) with ESMTP id
g3NAkvGs011206
	for <[email-masked]>; Tue, 23 Apr 2002 03:46:57 -0700
(PDT)
Received: from nwkea-mail-2.sun.com ([192.18.42.14])
	by engmail4.Eng.Sun.COM (8.9.3+Sun/8.9.3/ENSMAIL,v2.1p1) with
ESMTP id DAA23631
	for <[email-masked]>; Tue, 23 Apr 2002 03:46:57 -0700
(PDT)
Received: from dns1.shixun.net ([202.108.105.253])
	by nwkea-mail-2.sun.com (8.9.3+Sun/8.9.3) with ESMTP id DAA14452
	for <[email-masked]>; Tue, 23 Apr 2002 03:46:44 -0700
(PDT)
Received: from gaohong.mail ([202.108.105.116]) by dns1.shixun.net with
Microsoft SMTPSVC(5.0.2195.4453);
	 Tue, 23 Apr 2002 18:34:27 +0800
From: hinden <[email-masked]>
To: [email-masked]
Subject: A  funny website
FILETIME=[71F69BF0:01C1EAB2]
Date: 23 Apr 2002 18:34:28 +0800
Sender: [email-masked]
Precedence: bulk
------------------------------->8

When did Bob started using blukmailers ? :)
In other words these nice virii select their source addy based on
spamlists. very funny...
I know of a nice solution which I should write up to make it some kind
of standard.
Which at least circumvents source-email address spoofing as that is what
is happening now.
Especially if many IPv6 boxes will be deployed holes&misconfigs will
become more and more common
and spams will go higher and higher.

Greets,
 Jeroen