<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<HTML><HEAD>
<META http-equiv=Content-Type content="text/html; charset=ISO-8859-1">
<META content="MSHTML 5.50.4916.2300" name=GENERATOR></HEAD>
<BODY>
<DIV><SPAN class=024145914-20082002><FONT face=Arial color=#0000ff size=2>The
nature of the Klez virus to spoof sender in the header.. Read about the Klez
virus on Symantec.com or somewhere else will explain it.</FONT></SPAN></DIV>
<DIV> </DIV>
<P><FONT size=2>Matt Doherty<BR>IT Dept<BR>Datawatch Corp<BR><BR>>>In a
world without walls or fences, who needs Windows and Gates?<<</FONT> </P>
<BLOCKQUOTE>
<DIV class=OutlookMessageHeader dir=ltr align=left><FONT face=Tahoma
size=2>-----Original Message-----<BR><B>From:</B> Jonathan Arcand
[mailto:jonathan.arcand@CEGEPTR.QC.CA]<BR><B>Sent:</B> Tuesday, August 20,
2002 11:37 AM<BR><B>To:</B> MAILSCANNER@JISCMAIL.AC.UK<BR><B>Subject:</B> Why
the from and the sender are not the same thing?<BR><BR></FONT></DIV>Hi,
<BR><BR>I received some messages like this: <BR><BR><BR>> The following
e-mail messages were found to have viruses in them: <BR>> <BR>> Sender:
<Webmaster@cegeptr.qc.ca > <BR>> Recipient:
<infoprog@cegeptr.qc.ca> <BR>> Subject: Scrolling <BR>> MessageID:
g7KE78FF002666 <BR>> Report: /g7KE78FF002666/Yzdsr.scr Found the
W32/Klez.h@MM virus <BR>!!! <BR>> Windows Screensavers often hide viruses
in email in Yzdsr.scr <BR>> <BR>> Full headers are: <BR>>
Return-Path: <g> <BR>> Received: from Jcdyf
(hurricane-ppp29.sorel.cognicase.net [64.254.11.35]) <BR>> by
courrier.cegeptr.qc.ca (8.12.5/8.12.5) with SMTP id g7KE78FF002666 <BR>>
for <infoprog@cegeptr.qc.ca>; Tue, 20 Aug 2002 10:07:09 -0400 <BR>>
Date: Tue, 20 Aug 2002 10:07:08 -0400 <BR>> Message-Id:
<200208201407.g7KE78FF002666@courrier.cegeptr.qc.ca> <BR>> From:
webmaster <webmaster@johnabbott.qc.ca> <BR>> To:
infoprog@cegeptr.qc.ca <BR>> Subject: Scrolling <BR>> MIME-Version: 1.0
<BR>> Content-Type: multipart/alternative; <BR>>
boundary=BBowx3aO8i4OBHwS930B5Us0800A2M03 <BR>> <BR>> -- <BR>>
MailScanner <BR>> Email Virus Scanner <BR><BR>I don't understand why the
sender is webmaster@my.domain and in the header <BR>is
webmaster@johnabbott.qc.ca <BR><BR>The user's auto-response goes to
webmaster@cegeptr.qc.ca <BR><BR>I'm using mailsanner 3.20-7 with no spam
detection and Mcafee <BR><BR>Somenone knows what is my problem? <BR>Thanks!
<BR><BR>Jonathan <BR><BR></BLOCKQUOTE></BODY></HTML>