The "Klez" virus is famous for sticking in faked From: address, found in
the address book of the infected machine (if A knows B and A knows C, it
figures there's a reasonable chance B knows C).

  On several of the copies of Klez that I've received, however, there was an
additional "Reply-To:" header which the virus had not changed, pointing to
the actual infected machine.

David Gillett


On 8 Jan 2003, at 14:18, Rick Glazier wrote:

> I wrote a friendly message asking if others were complaining. If they could
> check their machine. Sent him a link to Norton so they could look up repair info.
> And it stopped after two virus messages.
> That virus does NOT seem to fake the senders address though...
> I checked that first since if if did, anything this "simple" would
> have been a waste of time.
>
>                                Rick Glazier
>
> From: "Don Weagant" <[log in to unmask]>
> > I am getting the same virus from the same person....I believe to is one
> > of the virus that send using Microsoft mail address books. I don't use
> > them so not sure. Mr. Clarkes e-mail address, seeems to be a valid
> > address. I believe that this is the virus that can changed the address
> > around, and send from one that says it is coming from someone else,
> > so he may not really have the virus....PCSOFT, seems to be the link,
> > as I don't know you or him. Mr Clarke's ISP is in Wales. Yes, there are
> > different bodies in the letter, but contain the same scr. I have received
> > about 15 letters from this address, I wrote to that address, and it did
> > not bounce, and the mail seems to have stopped from there.
>
>              Do you want to signoff PCSOFT or just change to
>                     Digest mode - visit our web site:
>                    http://freepctech.com/pcsoft.shtml

              The NOSPIN Group is now offering Free PC Tech
                     support at our newest website:
                          http://freepctech.com