Strange E-mails???

[Brian R.]

I received the following two e-mails today:

=================================
(from pmclalle@eastern.edu)
Hi,

Thanks for your message.

Eastern University is closed through Sunday, January 4, 2004. I will view your message on Monday the 5th when I return to the office.

Happy Holidays,

Peter
=================================

Never heard of him...

Also

=================================
(from NAV for Microsoft Exchange-USNYPEXCH1 <NAVMSE-USNYPEXCH1@iie.org>)

Subject: Norton AntiVirus detected a virus in a message you sent. The infected attachment was deleted.

Recipient of the infected attachment: CIESWEBMASTER\Inbox
Subject of the message: Happy Epiphany
One or more attachments were deleted
Attachment value.bat was Deleted for the following reasons:
Virus W32.Klez.H@mm was found.
==================================

Never sent such an e-mail with any attachment

Anyone have any ideas what is going on? I scanned all my HDs with NAV and found nothing. My computer has not been acting strangely and I am behind a firewall. My OS is W2K and I am using Outlook Express 6.00.2800.1123

[Marshmallowman]

If you are sure you computer is not infected, then someone with your email address in their addressbook proabbaly is.

But I would make sure your virus scanner is up to date and do a full scan scan just to be sure.

[Paddy]

Perhaps a reply-to-all out of office rule....

[drslump]

I think that someone is using your email address (not your account) to send spam/infected messages.

[drslump]

check here :

http://www.sophos.com/virusinfo/analyses/w32klezh.html

[Brian R.]

One of the mysteries is that neither of these addresses are in my contact list. I have never previously had any contact with them in any way. I sent the guy from Eastern.edu an additional e-mail that asked him to contact me if the e-mail attributed to me was strange in any way.

I will check on the presence of the w32klezh worm. Thanks drslump.

I did a complete scan of all my HDs and updated my NAV just before the scan.

Is there a way of scanning the HDs from an independent drive that cannot be infected. I am concerned about a virus or worm that prevents NAV or other virus-checking program from performing its function and thus not detecting the infected file.

I examined the list of open processes and didn't find anything suspicious, but I guess that is not really proof of anything.

[TransformX]

Relax, you're probably clean.
Someone sends spam using your email address (not your computer nor your internet account).

[Brian R.]

You're probably right.

Aside, congratulations on your marriage. May you both enjoy 100 years of happiness together and have great prosperity.

[TransformX]

Thanks
I've added a few pictures to the wedding thread today.

[Brian R.]

I saw them. I didn't have a religious wedding nor a significant reception (either time) so I missed out on alot of the celebration. I envy you...

[TransformX]

Wait till you have kids then

[Brian R.]

I am not deficient in that regard. I have 3.

[TransformX]

All you have to do now is wait till they get married

[Brian R.]

One is, he's 28.

[tonny]

Klez, uses spoofing like Bugbear, it uses a random address it finds on the computer as the sender and that's why you get the replies.

http://securityresponse.symantec.com/avcenter/venc/data/w32.klez.gen@mm.html

Email spoofing
Some variants of this worm use a technique known as "spoofing" by which the worm randomly selects an address it finds on an infected computer. The worm uses this address as the "From" address when it performs its mass-mailing routine. Numerous cases have been reported in which users of uninfected computers received complaints that they sent an infected message to another individual.