That may be true with some variants.
However my mail server has rejected the relay of several mails sent pretending
to be from me (envelope sender) to other parties and I think these could be
klez variants or another such virus. Since my server rejected them I cannot
be sure of the contents.
On Sunday 28 July 2002 04:06 am, Curt Sampson wrote:
> On Sat, 27 Jul 2002, Tom Lane wrote:
> > One of the nastier aspects of the Klez virus....
> >
> > However, even a trivial look at the detail mail headers (Received: etc)
> > will convince you that the spam did not originate from the claimed
> > "From:" address. If you care to post a few sets of complete headers,
> > we can probably triangulate pretty quickly on the virus-infected loser
> > who's originating these messages.
>
> It appears to me that the envelope sender is not forged by Klez.H,
> assuming that that's the virus I'm getting all the time. So you
> could check for the "Return-Path:" header, or maybe "From " (note:
> no colon) if you're using a Berkeley-mailbox style system, and find
> out the e-mail address of the real sender.
>
> cjs
