Hi Larry,

It didn't come from the Vanagon listserv, rather some Klez-infected machine
that uses verizon.net as the ISP.

One of the tricky things about the Klez virus is that it "spoofs" the "from"
address.

TomC

> -----Original Message-----
> From: Chase [SMTP:lchase@ATTGLOBAL.NET]
> Sent: Saturday, September 28, 2002 11:17 AM
> To:   vanagon@GERRY.VANAGON.COM
> Subject:      Virus Concern
>
> Volks,
>
> Just recieved a strange email from listserv@gerry.vanagon.com.
>
> Subject: MARGINWIDTH
>
> Snipped a bit of the details below.
>
> Is this a Virus concern?
>
> Of course I stipped out any possible offending code.
>
> Chase
>
> - - - - - - - -
>
> Snip
>
> >>> Received: from out012.verizon.net
> (out012pub.verizon.net[206.46.170.137])
>           by prserv.net (in4) with ESMTP
>           id <2002092813194010408d3mtde>; Sat, 28 Sep 2002 13:19:40 +0000
> Received: from Taubkznln ([66.255.51.130]) by out012.verizon.net
>           (InterMail vM.5.01.05.09 201-253-122-126-109-20020611) with SMTP
>           id <20020928131938.KIKF18399.out012.verizon.net@Taubkznln>
>           for <lchase@attglobal.net>; Sat, 28 Sep 2002 08:19:38 -0500
> From: listserv <listserv@gerry.vanagon.com>
> To: lchase@attglobal.net
> Subject: MARGINWIDTH
> MIME-Version: 1.0
> Content-Type: multipart/alternative;
>  boundary=RChXNj3M22310C3trWW9g50s1YF3amSL5
> Message-Id: <20020928131938.KIKF18399.out012.verizon.net@Taubkznln>
> Date: Sat, 28 Sep 2002 08:19:39 -0500
>
> --RChXNj3M22310C3trWW9g50s1YF3amSL5
> Content-Type: text/html;
> Content-Transfer-Encoding: quoted-printable
>
> <HTML><HEAD></HEAD><BODY>
> <iframe src=3Dcid:UGs659yC3m760563u8V height=3D0 width=3D0>
> </iframe>
> <FONT></FONT></BODY></HTML>
>
> --RChXNj3M22310C3trWW9g50s1YF3amSL5
> Content-Type: audio/x-wav;
>  name=Ek.pif
> Content-Transfer-Encoding: base64
> Content-ID: <UGs659yC3m760563u8V> <<<<