Date:         Sat, 4 May 2002 01:44:03 -0400
Reply-To:     David Beierl <dbeierl@ATTGLOBAL.NET>
Sender:       Vanagon Mailing List <vanagon@gerry.vanagon.com>
From:         David Beierl <dbeierl@ATTGLOBAL.NET>
Subject:      Re: Not Funny ..(no Van cont)
Comments: To: warmerwagen@HOTMAIL.COM
In-Reply-To:  <OE464nSvl1KE5bKw14E00006727@hotmail.com>
Content-Type: text/plain; charset="us-ascii"; format=flowed

At 12:44 AM 5/4/2002, Robert Keezer wrote:
>Hello Friday listees-
>This is not funny.
>I never warn the list of viruses, but today I recieved a e-mail addressed
>from Rubatoguy who has been on or still is on this list. The e-mail has
>two attachements, which I did not open .
>
>I don't think it is Rubatoguy, but a hacker.
>
>Rubatoguy hasn't ever e-mailed me personally, so I had to wonder-why is he
>sending me a anti-virus program for me to "download"? We have never
>discussed this or anything ever.
>SO beware- you could open this -for all I know, these hackers could use
>any of our familiar list names to trick us into opening a worm or other
>virus.

This is one of the many ways that the Klez family of worms distribute
themselves.  The message is not from Todd, but was sent by the Klez worm
from the infected machine of someone who has Todd's address (and yours) in
his system somewhere -- IOW almost anybody on the Vanagon list.  If you
examine the message headers you may be able to get an idea of where the
message actually came from.

You will find a description of Klez here:
http://www.viruslist.com/eng/viruslist.html?id=4292 along with a link to a
removal program.

david


--
David Beierl - Providence, RI
  http://pws.prserv.net/synergy/Vanagon/
'84 Westy "Dutiful Passage"
'85 GL "Poor Relation"