[Dev] Virus Alert... seriously

John Beimler dev@trilug.org
Mon, 6 May 2002 14:15:42 -0400


begin  quotation from Jeremy P <jeremyp@pobox.com> [on 020506 12:43]:

> 
> Hey everyone,
> Someone on this list has the "Klez" virus.
> 
and that someones email headers look like this:

Return-Path: <dev-admin@trilug.org>
[...]
Received: from fatalpha.trilug.org (localhost.localdomain [127.0.0.1])
        by fatalpha.trilug.org (8.11.6/8.11.6) with ESMTP id g46GAH330287;
        Mon, 6 May 2002 12:10:17 -0400
Received: from out002.verizon.net (out002pub.verizon.net [206.46.170.141])
        by fatalpha.trilug.org (8.11.6/8.11.6) with ESMTP id g46G8a330256
        for <dev@trilug.org>; Mon, 6 May 2002 12:08:36 -0400
Received: from Baqrddn ([213.8.53.81]) by out002.verizon.net
          (InterMail vM.5.01.04.05 201-253-122-122-105-20011231) with SMTP
          id <20020506160428.RBT4379.out002.verizon.net@Baqrddn>
          for <dev@trilug.org>; Mon, 6 May 2002 11:04:28 -0500
[...]

so if the name Baqrddn looks familiar to you, or you are relaying
through verizon.net, its probably you.  (Wish it was RR, they catch who
is actually sending the mail, much easier to identify the true sender)

Peace.

john