Anyone have a Bellsouth e-mail address?

The klez virus uses a fake return address, but there is sometimes slightly helpful information in the properties\headers. I think the actual sending computer has a Bellsouth e-mail address.

I AM NOT ACCUSING ANYONE OF DELIBERATELY OR ACTIVELY SENDING ANYTHING. I just think it might be a good idea for people to check their computers for viruses. Klez can delete files on the 6th and 13th days of months.

HEADERS:

Received: from imf05bis.bellsouth.net ([205.152.58.145]) by mc3-f12.law16.hotmail.com with Microsoft SMTPSVC(5.0.2195.5600);
Wed, 27 Nov 2002 14:56:16 -0800
Received: from Sfgewawa ([68.18.84.245]) by imf05bis.bellsouth.net (InterMail vM.5.01.04.19 201-253-122-122-119-20020516) with SMTP id < 20021127225757.ZOQK20530.imf05bis.bellsouth.net @ Sfgewawa > for < davidransom @ hotmail.com >; Wed, 27 Nov 2002 17:57:57 -0500
From: Eileen < Eileen @ barndoors.com >
To: davidransom @ hotmail.com
Subject: Re:davidransom,welcome to my hometown
MIME-Version: 1.0
Content-Type: multipart/alternative;
boundary=Be4U97ERN04c180S
Message-Id: < 20021127225757.ZOQK20530.imf05bis.bellsouth.net @ Sfgewawa >
Date: Wed, 27 Nov 2002 17:58:04 -0500
Return-Path: clubbj @ bellsouth.net
X-OriginalArrivalTime: 27 Nov 2002 22:56:16.0662 (UTC) FILETIME=[313CAB60:01C29668]

I work at a university in the computer networking area, and I know what you mean - I've been seeing a fairly large resurgence of that virus myself.

I don't know if it is a new variation or what, but luckily our email server is catching most of them...

FWIW,
Howard H.