[EMAIL PROTECTED] wrote:
ScanMail has detected a virus during a real-time scan of the email traffic.
Date: 8/31/2002 10:27:8
Subject: A very nice game
Virus: WORM_KLEZ.H
File: picacu.exe
From: debian-security <debian-security@lists.debian.org>
To: [EMAIL PROTECTED];
Action: Uncleanable, Deleted;
Scanned by ScanMail for Lotus Notes 2.5
with scanengine 6.150-1001
and patternfile lpt$vpn.339
http://www.trendmicro.com/vinfo/virusencyclo/default5.asp?VName=WORM_KLEZ.H&VSect=T
Abstract:
Similar to the other KLEZ variants, this worm can change or spoof the
original
email address in the FROM: field. It obtains the email addresses that it
places
in the FROM: field from the infected user's address book.
This causes a non-infected user to appear as the person who has sent this
worm's malicious email. It does this to hide the real sender of the
infected email.
The actual email address of the sender is found in the Envelope From field.
So it doesn't come from debian-security, sorry.
Phil
