NANFA-- f.y.i. on the klez virus
Wed, 8 Jan 2003 08:01:41 -0500

klez has the abililty to "spoof" the return addresses so just 'cause it
looks like it's
from person A, it could be from person B..
from the symantec web site:

This worm searches the Windows address book, the ICQ database, and local
files for email addresses. The worm sends an email message to these
addresses with itself as an attachment. The worm contains its own SMTP
engine and attempts to guess at available SMTP servers. For example, if the
worm encounters the address it will attempt to send email
via the server

The subject line, message bodies, and attachment file names are random. The