Headers for that little bit of Klez were:
Return-Path:
<sentto-4046267-8809-1033536420-takel=takelwindfeather.com_at_returns.groups.ya
hoo.com>
Received: from n7.grp.scd.yahoo.com (n7.grp.scd.yahoo.com [66.218.66.91])
by www.webslum.org (8.9.3/8.9.3) with SMTP id CAA27045
for <takel_at_takelwindfeather.com>; Wed, 2 Oct 2002 02:28:22 -0400
X-eGroups-Return:
sentto-4046267-8809-1033536420-takel=takelwindfeather.com_at_returns.groups.yah
oo.com
Received: from [66.218.67.199] by n7.grp.scd.yahoo.com with NNFMP; 02 Oct
2002 05:27:00 -0000
X-Sender: exp60_at_bellsouth.net
X-Apparently-To: SkunkworksAMA_at_yahoogroups.com
Received: (EGP: mail-8_1_1_4); 2 Oct 2002 05:26:59 -0000
Received: (qmail 49011 invoked from network); 2 Oct 2002 05:26:58 -0000
Received: from unknown (66.218.66.217)
by m6.grp.scd.yahoo.com with QMQP; 2 Oct 2002 05:26:58 -0000
Received: from unknown (HELO imf32bis.bellsouth.net) (205.152.58.72)
by mta2.grp.scd.yahoo.com with SMTP; 2 Oct 2002 05:26:58 -0000
Received: from Fyb ([216.79.224.126]) by imf07bis.bellsouth.net
(InterMail vM.5.01.04.19 201-253-122-122-119-20020516) with SMTP
id <
20021001214314.YDK23154.imf07bis.bellsouth.net_at_Fyb>
for <SkunkworksAMA_at_yahoogroups.com>;
Tue, 1 Oct 2002 17:43:14 -0400
To: SkunkworksAMA_at_yahoogroups.com
Message-Id: <
20021001214314.YDK23154.imf07bis.bellsouth.net_at_Fyb>
From: themeanmouse <themeanmouse_at_hotmail.com>
X-Yahoo-Profile: themeanmouse
MIME-Version: 1.0
Mailing-List: list SkunkworksAMA_at_yahoogroups.com; contact
SkunkworksAMA-owner_at_yahoogroups.com
Delivered-To: mailing list SkunkworksAMA_at_yahoogroups.com
Precedence: bulk
List-Unsubscribe: <mailto:SkunkworksAMA-unsubscribe_at_yahoogroups.com>
Date: Tue, 1 Oct 2002 17:43:41 -0400
Subject: [SkunkworksAMA] Leftmargin
Reply-To: SkunkworksAMA_at_yahoogroups.com
Content-Type: multipart/alternative;
boundary="W87DLot0L451zTf745I"
X-UIDL: !Rn!!PE""!)fY!!EaW"!
Seems that it was from whoever has 'themeanmouse' as their Yahoo! Profile,
and (seemingly) has exp60_at_bellsouth.net as their e-mail.
Here's a Klez removal link:
http://securityresponse.symantec.com/avcenter/venc/data/w32.klez.removal.too
l.html
Honestly, you'd think people would have their antivirus software patched by
now.
Received on Tue Oct 01 2002 - 23:10:32 CDT