RE: Klez Worm Info

The Klez worm fakes its from address. Try checking the offending message's header to see whom it is actually from.

Things are not always simple. A short time ago, I was asked if I had a virus as someone was receiving multiple copies of mail I sent to either this list or lazydba. I made the usual protestations of living a good life and having "protected" mail. The person replied they received six copies of my denial. That same day maintenance was being done and our mail gateway was temporarily closed. I received a message saying an outgoing mail message was blocked by this closure; the one saying, "No way is it I." Before I apologized, many times over :), I queried our postmaster about the problem. She explained that the site which was receiving multiple copies was running a mail program with a bug. The bug kept the system from sending an acknowledgement of receipt to our system. Having received no receipt, our system was resending the message over and over again. She contacted their postmaster and I trust all is well.

Ian MacGregor
Stanford Linear Accelerator Center
ian_at_SLAC.Stanford.edu

-----Original Message-----
Sent: Monday, November 25, 2002 12:04 PM To: Multiple recipients of list ORACLE-L

Martin Kendall wrote:
>
> My Norton Antivirus reports that Stephane's email re. "How to pass
> value from SQL*Plus to Unix scripts?" contains the W32.Klez.H_at_mm virus
> in an "item" called stars-bkgrd.
>
> Anyone else had same alert ?
>
> Martin
>
> ------------------------------------------------------------------------
> Name: smime.p7s
> smime.p7s Type: PKCS7 Signature (application/x-pkcs7-signature)
> Encoding: 7bit

Sorry for the trouble, folks, but I have trouble understanding. When I am answering the list, it is either from a Linux machine (and netscape) - not infected by W32.Klez.H_at_mm according to the Symantec site - or from a mail web interface. I sent the e-mail mentioned above on October 22nd or October 23rd (two answers to the same question) more than one month ago, and from Linux. I hope that somebody is not harvesting the list ... If anybody has any hint about how to check for viruses on a Linux machine, BTW ...

-- 
Regards,

Stephane Faroult
Oriole Software
-- 
Please see the official ORACLE-L FAQ: http://www.orafaq.com
-- 
Author: Stephane Faroult
  INET: sfaroult_at_oriole.com

Fat City Network Services    -- 858-538-5051 http://www.fatcity.com
San Diego, California        -- Mailing list and web hosting services
---------------------------------------------------------------------
To REMOVE yourself from this mailing list, send an E-Mail message
to: ListGuru_at_fatcity.com (note EXACT spelling of 'ListGuru') and in the message BODY, include a line containing: UNSUB ORACLE-L (or the name of mailing list you want to be removed from).  You may also send the HELP command for other information (like subscribing).
-- 
Please see the official ORACLE-L FAQ: http://www.orafaq.com
-- 
Author: MacGregor, Ian A.
  INET: ian_at_SLAC.Stanford.EDU

Fat City Network Services    -- 858-538-5051 http://www.fatcity.com
San Diego, California        -- Mailing list and web hosting services
---------------------------------------------------------------------
To REMOVE yourself from this mailing list, send an E-Mail message
to: ListGuru_at_fatcity.com (note EXACT spelling of 'ListGuru') and in
the message BODY, include a line containing: UNSUB ORACLE-L
(or the name of mailing list you want to be removed from).  You may
also send the HELP command for other information (like subscribing).