posted 08-07-2002 11:19 AM ET (US)        

It purported to come from jimh, but Klez
randomly selects one of your correspondents
for the From:, so that's a lie.

The subject was Caribee Boat Sales, which may
also be familiar to the infectee.

For more info on Klez, go to
http://www.symantec.com/avcenter/vinfodb.html
and do a search on Klez.

posted 08-07-2002 02:16 PM ET (US)            

What email do you use? I use outlook because it came bundled with my DSL -- unfortunately my Eudora seems prone to crashing.

Chuck

Same thing happened to me today, too. McAfee picked it right up -- even thought I never open attachments without scanning, especially when the subject is "Hey Morocco look my beautiful girl"

posted 08-07-2002 10:24 PM ET (US)            

The way Klez works is that it scans for
e-mail addresses (I don't remember if it's
your address book or your e-mails) and sends
itself to those it finds, randomly selecting
the From: amongst those.

So what happened is that someone became
infected with Klez, and that someone had
both my e-mail address and JimH's in a place
Klez could find it. Klez picked JimH as the
From: and me (and everybody else) as the to:,
and sent itself on. I could tell it was
Klez by eyeball.

Klez uses a variety of subject lines to try
to get you to open the attachment. Those
subject lines vary from technical ("Klez
removal tool" or somesuch to porn. It
doesn't matter whether you run OE or Netscape
or Mozilla or whatever. If you open it,
you get infected. Now, if you haven't kept
up on your OE maintenance, you can get
infected without explicitly opening the
attachment. Anybody who doesn't keep up
on OE maintenance is asking to get infected.

BTW, I use Netscape 4.79 for e-mail, and
will migrate to the latest Mozilla when
either have some time to migrate some hacks
I did on Netscape to allow me to read mail
from several different systems, OR the need
to read from several systems goes away
(Nov 15 is the plan of record).