Re: VERY nasty mass mailing

[Phil Gregory <pgregory@xxxxxxxxxxx>]

The explanation for the email has been voiced, but not terribly clearly.
So my email is somewhat redundant, but hopefully usefully so.

Do you know the people the sent the email?  If so, the scenario is pretty
simple:

* A Klez-infected computer sent an email to the people who emailed you.
  Klez picks both the destination and origin emails at random from the
  infected computer's address book (among other places), so the infected
  computer could be anywhere.  (You can use the email headers to track
  down the true originating host, though.)

* This Klez variant is the one that claims to actually be a program to
  prevent Klez (ingenious, no?), so it send the message you saw.

* The recipients of the email are using Symantec's anti-virus program, and
  it catches the virus.  Being helpful, they email you to let you know
  that you're infected.  (They don't realize that Klex fakes email
  headers.)  They recommend the program that caught the virus for them.

* You get their message.

If you don't know the people that sent it (who are Shelly and Jeff?), then
it's probably a fake.  The only motive I really see for this is if
Symantec sent it, hoping to use it as some sort of advertising.  Its
possible a Symantec rival sent it instead, but that seems a but too
subtle.

The best way to check on the origin of any email is to look at the
Received: headers.  Those cannot be faked by the sender because they're
added after the email is sent.  (Note that fake headers *can* be added to
the email before it's sent, so it can look like the actual origin is just
another hop along the way.)