# Klez virus; who sent it to me? **URL:** \ **Category:** Factual Questions\ **Created:** [May 17, 2002, 2:42pm UTC](https://boards.straightdope.com/t/klez-virus-who-sent-it-to-me/109559 "2002-05-17T14:42:09Z")\ **Posts on this page:** 12\ **Page:** 1
**Author:** ![Mangetout](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/mangetout/32/19_2.png) [@Mangetout](https://boards.straightdope.com/u/Mangetout)\ **Post date:** [May 17, 2002, 2:42pm UTC](https://boards.straightdope.com/t/klez-virus-who-sent-it-to-me/109559/1 "2002-05-17T14:42:09Z")
I got a message titled ‘Welcome to my hometown’ today; there wasn’t a virus attached because my mail server automatically deletes suspicious attachments (and I have secondary precaustions in place anyway). The message is claiming to be from me though (my personal email address), addresses to my business address. How can I tell who really sent it? ---
**Author:** ![RealityChuck](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/realitychuck/32/195_2.png) [@RealityChuck](https://boards.straightdope.com/u/RealityChuck)\ **Post date:** [May 17, 2002, 3:09pm UTC](https://boards.straightdope.com/t/klez-virus-who-sent-it-to-me/109559/2 "2002-05-17T15:09:30Z")
You probably can’t. Klez chooses an e-mail address at random for the From: field, so that’s no help. You can check the headers and see what domain it originated with. But it’s likely that’ll only tell you it came from [aol.com](http://aol.com) or some sort and make it impossible to pinpoint it further. You can read bout it at Symantec. [http://securityresponse.symantec.com/avcenter/venc/data/w32.klez.gen@mm.html](http://securityresponse.symantec.com/avcenter/venc/data/w32.klez.gen@mm.html) ---
**Author:** ![Mangetout](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/mangetout/32/19_2.png) [@Mangetout](https://boards.straightdope.com/u/Mangetout)\ **Post date:** [May 17, 2002, 3:28pm UTC](https://boards.straightdope.com/t/klez-virus-who-sent-it-to-me/109559/3 "2002-05-17T15:28:56Z")
how did it manage to choose my home email address for the ‘from’ and my work one for the ‘to’; does this mean that it’s been (unwittingly) sent by someone who has communicated with me at both addresses? ---
**Author:** ![abel](https://avatars.discourse-cdn.com/v4/letter/a/2acd7d/32.png) [@abel](https://boards.straightdope.com/u/abel)\ **Post date:** [May 17, 2002, 3:31pm UTC](https://boards.straightdope.com/t/klez-virus-who-sent-it-to-me/109559/4 "2002-05-17T15:31:06Z")
Yes, that’s what it means. It picked your personal address to fool you into thinking it came from you, and sent it to your business address. I guess the virus maker didn’t anticipate that situation. 🙂 ---
**Author:** ![Mangetout](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/mangetout/32/19_2.png) [@Mangetout](https://boards.straightdope.com/u/Mangetout)\ **Post date:** [May 17, 2002, 4:00pm UTC](https://boards.straightdope.com/t/klez-virus-who-sent-it-to-me/109559/5 "2002-05-17T16:00:16Z")
That narrows it down a little; I managed to track it down as originating from a domain that only appears twice in my inbox, so I’ve written a friendly message to both of the possbile senders. ---
**Author:** ![Musicat](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/musicat/32/20189_2.png) [@Musicat](https://boards.straightdope.com/u/Musicat)\ **Post date:** [June 13, 2002, 12:50pm UTC](https://boards.straightdope.com/t/klez-virus-who-sent-it-to-me/109559/6 "2002-06-13T12:50:37Z")
Although klez typically grabs two random email addresses from your personal address book, puts one in the “To” field and one in the “From” field before mailing, the address book is not the only place it finds addresses. According to [Trend Micro,](http://antivirus.com) it also looks in other files, too: [Tech info about klez.h](http://www.antivirus.com/vinfo/virusencyclo/default5.asp?VName=WORM_KLEZ.H&VSect=T) So, **Mangetout,** the idea that someone has both your addresses in their WAB is good, but might not be culprit here. Pretty Klever, that Klez. ---
**Author:** ![Mangetout](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/mangetout/32/19_2.png) [@Mangetout](https://boards.straightdope.com/u/Mangetout)\ **Post date:** [June 13, 2002, 12:57pm UTC](https://boards.straightdope.com/t/klez-virus-who-sent-it-to-me/109559/7 "2002-06-13T12:57:59Z")
Interesting… It did turn out to be one of the two people I contacted (who was already aware and dealing with it. My work email gets forwarded automatically to my out-of-office address, so very often I respond to messages sent to Me@work from Me@home and vice versa, so I suspect that it did get my addresses from the address book in this case. ---
**Author:** ![Gozu\_Tashoya](https://avatars.discourse-cdn.com/v4/letter/g/7993a0/32.png) [@Gozu\_Tashoya](https://boards.straightdope.com/u/Gozu_Tashoya)\ **Post date:** [November 6, 2002, 7:58am UTC](https://boards.straightdope.com/t/klez-virus-who-sent-it-to-me/109559/8 "2002-11-06T07:58:36Z")
Well, rather than start a thread of my own… I just got a klez email that was more fun than usual. It had my address in the “To:” my roomie’s email address in the “From” and a third, unknown, email address in the “reply-to” field. Is that the address it _really_ came from, or did I just get a new, fun, version of klez? ---
**Author:** ![Smashed\_Ice\_Cream](https://avatars.discourse-cdn.com/v4/letter/s/ed8c4c/32.png) [@Smashed\_Ice\_Cream](https://boards.straightdope.com/u/Smashed_Ice_Cream)\ **Post date:** [November 6, 2002, 11:27am UTC](https://boards.straightdope.com/t/klez-virus-who-sent-it-to-me/109559/9 "2002-11-06T11:27:37Z")
Ooh, I’m going to jump in with yet another question about it: My mom got a dozen-ish emails the other week, one “from” my sister, a few “from” some of her friends, and a few other “from” various family members. My sister seems to be the only common link in all the addresses, my mother was the only receipient of the mails, and my sister’s computer came up clean. How could that one have happened? ---
**Author:** ![jjimm](https://avatars.discourse-cdn.com/v4/letter/j/ba8739/32.png) [@jjimm](https://boards.straightdope.com/u/jjimm)\ **Post date:** [November 6, 2002, 11:44am UTC](https://boards.straightdope.com/t/klez-virus-who-sent-it-to-me/109559/10 "2002-11-06T11:44:22Z")
[Symantec:](http://securityresponse.symantec.com/avcenter/venc/data/w32.klez.gen@mm.html) > [@](#): > > Some variants of this worm use a technique known as “spoofing.” If so, the worm randomly selects an address that it finds on an infected computer. It uses this address as the “From” address that it uses when it performs its mass-mailing routine. Numerous cases have been reported in which users of uninfected computers received complaints that they sent an infected message to someone else. Thus your sister would be the infected one, and the people apparently sending the virus would actually be random names from your sister’s address book. ---
**Author:** ![RealityChuck](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/realitychuck/32/195_2.png) [@RealityChuck](https://boards.straightdope.com/u/RealityChuck)\ **Post date:** [November 6, 2002, 2:10pm UTC](https://boards.straightdope.com/t/klez-virus-who-sent-it-to-me/109559/11 "2002-11-06T14:10:16Z")
Not necessarily. All it means is that your sister’s address and the address of the recipient were on the same computer. I don’t know how often Klez switches the From: address, but it’s perfectly possible that it took your sister’s e-mail and used it more than once. It can be from anyone who has both addresses anywhere on their computer (not just in the address book). ---
**Author:** ![Musicat](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/musicat/32/20189_2.png) [@Musicat](https://boards.straightdope.com/u/Musicat)\ **Post date:** [November 6, 2002, 2:41pm UTC](https://boards.straightdope.com/t/klez-virus-who-sent-it-to-me/109559/12 "2002-11-06T14:41:49Z")
And while we’re on the subject, I just got a message that was prefixed by this: > [@](#): > > Warning: This message has had one or more attachments removed. > Warning: Please read the “VirusWarning.txt” attachment(s) for more information. The body of the msg was a SPAM ad (probably), something relating to Northwest Airlines Frequent Flyer Miles. The attachment looks like this (I have condensed it a trifle): > [@](#): > > This is a message from the MailScanner E-Mail Virus Protection Service > > The original e-mail attachment “CELLPHONE NO’S.doc.scr” is on the list of unacceptable attachments for this site and has been replaced by this warning message. > > If you wish to receive a copy of the original attachment, please e-mail helpdesk and include the whole of this message in your request. Alternatively, you can call them, with the contents of this message to hand when you call. > > At Mon Nov 4 10:12:10 2002 the virus scanner said: Windows Screensavers often hide viruses in email in CELLPHONE NO’S.doc.scr > > Note to Help Desk: Look on the MailScanner in /var/spool/MailScanner/quarantine (message gA4GAqu6004452). > > Postmaster My ISP said his system did not generate this. Could it be generated by the sending ISP? But why would a SPAMmer use an ISP that had an outgoing virus scanner? Somebody is sure wasting a lot of Internet time with this crap. The warnings are worse than the disease.