Source of Klez infection

I've read enough about W32.Klez on some of the web sites to be generally familiar with it, but I'm wondering if anyone has found answers to the following:

Does a line in the full header of an infected message show the address of the source of the infected message? (For those newbies unfamiliar with this, I mean the "return path" source shown when you right click a message in the inbox and choose "options' in Outlook or "properties" in Outlook Express.) I know that the address in the "From" line of Klez-infected messages is normally either another address found on the infected machine or chosen from a list of random addresses.

It sure would be nice to know whose machine these are really coming from.

Is the "from" in the header record differant than the one that appears on the e-mail?

I haven't found a way to get the actual sender yet, but if I figure it out.....

Quote:

---

Originally posted here by souleman
I haven't found a way to get the actual sender yet, but if I figure it out.....

---

In my shop, I have an e-mail gateway that intercepts the inbound e-mail and scans it before passing it along to my SMTP server(you might be able to do it at the sendmail server as well). I noticed that the "From" address on my Gateway is different than the "From" address after the e-mail has been cleaned and passes along to the user. I have asked the vendor about this and their response was "the address on the gateway, may or may not be the originator, it depends on how mangled the header record is after the virus get through with it.
What I have done is look for 'repeat addresses' on my gateway (people that seem to be sending us a lot of infected e-mails). When I identify one, I send them a polite note suggesting they may have a Virus. I point them to information on the virus, a page where they can perform an online scan and a link to a tool that will remove the virus. So far this seems to have worked(I have helped out about a half dozen people so far).

Thanks for the replies. Yes, DjM, the ones I have received have had a different address in the "From" box than was shown as return-path in the full header. As it turns out, my friend, whose address was shown in the "return-path" on both messages, does have an infected machine. But she told me initially that she hadn't even turned her computer on the first day I got one of the infected messages. And the first message was totally different from the second. That led me to wonder at first if these messages had come from someone else we both knew who had both of our addresses in their address book.

Interesting, though, if it is a case that the full header can sometimes, but not always, identify the source of the infection. You'd think it would be an either/or situation.

For what it is worth, I recently received two Klez-infected emails. The From portions of the headers were different, but the ReturnPath of both were the same. Does this indicate that the same infected PC was the source of both?
From: [email protected]
Ret: [email protected]
From: [email protected]
Ret: [email protected]
In this example, could TyphoidMary be the address of the infected PC? :confused:

BTW, on both emails, the From portion of the header is the same as the From portion of the email interface.

Bucket - I'd certainly contact TyphoidMary and let her know her computer mightbe infected with the worm. But from what DjM says, it sounds as though it is possible that that might not be the source, too. So I'd include a link to some of the AV literature which shows how the worm can spoof addresses, so if her AV scan comes up clean she won't panic.

BTW Bucket, we have something in common. I'll update my profile.

I'm pretty sure you can

this was theheader i received a couple of days ago....

Quote:

---

Received: from Lfgf (ACA932A8.ipt.aol.com [172.169.50.168])
by smtp.gotnet.net (8.11.6/8.11.6) with SMTP id g3L3ESK25611
for <[email protected]>; Sat, 20 Apr 2002 20:14:28 -0700

---

the visible sender was

Quote:

---

billboards <[email protected]>

---

but it was the aol address that sent it

The potential carrier is [email protected] . To find out who/what this person is, I need a certain online database that is now offline-dead. :fpissed:

It seems to be too much of a coincidence that his/her email address appeared as the return path of 2 virus infected emails.
While I have read that Klez spoofs the From portion of an email address, I havven't read anything about a spoofed return path.
:shocked:
I did send a warning Hotmail to the twlakes.net address. Hope that it does some good.
:brickwall

I'm like you guys, I haven't been able to determine the true source of the email and I'm not sure if it is possible. I've been so busy with some other hardware installs and setups that I haven't had time to investigate Klez too deeply. However, I had to clean some machines that got infected with that damn virus the other day.

Oh, boy, this may get interesting! I just received another Klez infected message. And if the sender is the one listed in the return path of the header, it is the secretary of a large group to which I belong. That would mean infected messages went out to everyone in the group. These are mostly middle age and elderly ladies, many who just don't pay much attention to such things as antivirus protection. I'll bet they will be more educated after this!

I called the group secretary, and she already has a friend over there looking at her computer, thinking she might have a virus. So again it really does sound like the return path address might be correct.

Reading the headers can give you a clue as to its origin. I took the IP address, traced it back and it belonged to a client. A quick phone call, and they started scanning PC's. They found one with over 200 infected files, and unplugged it from the network then started cleaning.

I just called the individual in the Return path, bemyers. He told me that his computer was infected with a virus, but that he "fixed it" yesterday afternoon.
Looks like the Return Path theory is correct.

HMM..., I have been dealing with one version of klez in which the "return path" is not the person with an infected machine. We have a fairly reliable AV setup, which scans all inbound messages, among other things...

One of our users was recieving lots of undeliverable messages from postmaster at many different domains having to do with klez, after checking into it, I found that

1. Our users email address was in the return path of the original message
2. Many different addresses were in the "From" address.
3. There was an IP address listed in the header, which was not related to us in any way. I went to the ISP to whom the IP was registered, and they confirmed that the entity which used that IP address did indeed have a problem and that we were not the only was to complain, and that it was being cleaned up.
4. None of our users were infected.

It seems that at least one version of klez also modifies the return path.

Either that, or this is evidence that someone related to the offending IP address may have been attempting to access our users mail without authorization, or send mail from our user fro some purpose, never removed the settings, and klez grabbed them.

I do however know without question that the user in question was never infected by klez, on any machine which he uses.

I do know of some people who have been initially infected by klez from opening attachments in messages returned to them as undeliverable(which they didnt send out in the first place) because they were in the return path. Not at my organization, but some friends have had this happen.

Also possible is that klez may send out messages claiming to be postmaster bounce messages from your own domain.

check this link.

http://[email protected]

If someone whose address is in the return path is infected it may well be that they are not the source of the messages that you are recieving, but are infected as a secondary effect of someone elses infection.

IchNiSan

Could the ReturnPath theory work on Klez.G/H and fail on Klez.E ?

It could very possibly work on some, and not on others, I havent taken the time to study it fully, as I am mainly interested in making sure we dont get it, but there are lots of different behaviors that seem to pop up.

As I said, it is also possible that you are right about the return path, and what I am seeing is evidence that someone was trying to mess with one of our users mail, and never changed their settings back, then got infected. Or, stole a computer which this user had used before.. etc.. etc.. myriad other possibilities here..

I cant say for sure now. Not getting as much info out of the ISP as I would like about the source ip I found, and what the exact deal is with them. I understand why, but it is frustrating to say the least.

Maybe I will take the time to study it some.

HeyIchNiSan:
Zigar pointed out that Klez has been found to be infected with W95.CIH.1049. See:

http://sarc.com/avcenter/venc/data/w95.cih.1049.html

Someone must solve this problem before August 2nd, the trigger date for that version of CIH.
:deal: