It probably is not coming from where it appears. We have an alias for a group of us that field questions on a particular application. Every once in awhile we get a message that this virus has been found in a message that we have sent (supposedly from this alias). Since we are not sending under that alias we know that it is coming from somewhere else.
Apparently when a machine is infected it sends out messages randomly using addresses from the addressbook for the to, from, and reply to. I'm guessing that if it is using an actual message for the basis of this it could also be using the from as well as the subject of that message. Pat > > Martin Kendall wrote: > > > > My Norton Antivirus reports that Stephane's email re. "How to pass > > value from SQL*Plus to Unix scripts?" contains the W32.Klez.H@mm virus > > in an "item" called stars-bkgrd. > > > > Anyone else had same alert ? > > > > Martin > > > > ------------------------------------------------------------------------ > > Name: smime.p7s > > smime.p7s Type: PKCS7 Signature (application/x-pkcs7-signature) > > Encoding: 7bit > > > Sorry for the trouble, folks, but I have trouble understanding. When I > am answering the list, it is either from a Linux machine (and netscape) > - not infected by W32.Klez.H@mm according to the Symantec site - or from > a mail web interface. I sent the e-mail mentioned above on October 22nd > or October 23rd (two answers to the same question) more than one month > ago, and from Linux. I hope that somebody is not harvesting the list ... > If anybody has any hint about how to check for viruses on a Linux > machine, BTW ... > > -- > Regards, > > Stephane Faroult > Oriole Software > -- > Please see the official ORACLE-L FAQ: http://www.orafaq.com > -- > Author: Stephane Faroult > INET: [EMAIL PROTECTED] > > Fat City Network Services -- 858-538-5051 http://www.fatcity.com > San Diego, California -- Mailing list and web hosting services > --------------------------------------------------------------------- > To REMOVE yourself from this mailing list, send an E-Mail message > to: [EMAIL PROTECTED] (note EXACT spelling of 'ListGuru') and in > the message BODY, include a line containing: UNSUB ORACLE-L > (or the name of mailing list you want to be removed from). You may > also send the HELP command for other information (like subscribing). > -- Please see the official ORACLE-L FAQ: http://www.orafaq.com -- Author: Pat Hildebrand INET: [EMAIL PROTECTED] Fat City Network Services -- 858-538-5051 http://www.fatcity.com San Diego, California -- Mailing list and web hosting services --------------------------------------------------------------------- To REMOVE yourself from this mailing list, send an E-Mail message to: [EMAIL PROTECTED] (note EXACT spelling of 'ListGuru') and in the message BODY, include a line containing: UNSUB ORACLE-L (or the name of mailing list you want to be removed from). You may also send the HELP command for other information (like subscribing).