skuzzy need some litle help please

[minus]

well is it litle of topic , but some buger realy anoying me vith virus ,es

 looks like  is it not some one  HTC BBS  but never know
\
and with all the the fake mails crap not realy  easy to know from where is it come , can you take a look at this 2 propriety files ?

please ?

Return-Path:
Received: from satanas.europeonline.net ([194.177.33.67] verified)
  by mail01.europeonline.com (CommuniGate Pro SMTP 3.5.4)
  with ESMTP id 8274376 for 10940496@cgate.europeonline.com; Mon, 07 Apr 2003 21:54:08 +0200
Received: (from root@localhost)
   by satanas.europeonline.net (8.12.9/8.12.9) id h37Js7tw008152
   for 10940496@cgate.europeonline.com; Mon, 7 Apr 2003 21:54:07 +0200
Received: from mwinf0304.wanadoo.fr (smtp4.wanadoo.fr [193.252.22.28])
   by satanas.europeonline.net (8.12.9/8.12.9) with ESMTP id h37Jr5eN006978
   for ; Mon, 7 Apr 2003 21:53:06 +0200
Received: from Qjzkxcu (ANice-106-1-5-57.abo.wanadoo.fr [80.14.106.57])
   by mwinf0304.wanadoo.fr (SMTP Server) with SMTP id 5B1D8A802648
   for ; Mon,  7 Apr 2003 21:52:46 +0200 (CEST)
From: "facture.clients"
To: lvf01@europeonline.com
Subject: Done.
MIME-Version: 1.0
Content-Type: multipart/alternative;
   boundary=W4VC7y9N87


and the second
Return-Path:
Received: from satanas.europeonline.net ([194.177.33.67] verified)
  by mail01.europeonline.com (CommuniGate Pro SMTP 3.5.4)
  with ESMTP id 8333129 for 10940496@cgate.europeonline.com; Wed, 09 Apr 2003 19:50:45 +0200
Received: (from root@localhost)
   by satanas.europeonline.net (8.12.9/8.12.9) id h39HoiZn016076
   for 10940496@cgate.europeonline.com; Wed, 9 Apr 2003 19:50:44 +0200
Received: from mwinf0302.wanadoo.fr (smtp4.wanadoo.fr [193.252.22.28])
   by satanas.europeonline.net (8.12.9/8.12.9) with ESMTP id h39HneeN015348
   for ; Wed, 9 Apr 2003 19:49:41 +0200
Received: from Hifzcufob (ANice-106-1-8-98.abo.wanadoo.fr [81.49.131.98])
   by mwinf0302.wanadoo.fr (SMTP Server) with SMTP id D49D7C00065F
   for ; Wed,  9 Apr 2003 19:49:20 +0200 (CEST)
From: webmaster
To: lvf01@europeonline.com
Subject: A special  powful tool
MIME-Version: 1.0
Content-Type: multipart/alternative;
   boundary=OI4M09c4nr6A46JU648bb8l
Message-Id: <20030409174920.D49D7C00065F@mwinf0302.wanadoo.fr>
Date: Wed,  9 Apr 2003 19:49:20 +0200 (CEST)
X-Loop: forward.europeonline.com

[Skuzzy]

Both of thoise originated at wanadoo.fr.  This ISP is notorius for allowing SPAMMERS and hackers to reside on thier networks.

While running AppLink, I had at one time completely shut off access from wanadoo.fr, along with many other ISP's due to the problem.  They will not do anything about it either.

Send these headers to your ISP.  If they get enough complaints, maybe they will block wanadoo.fr as well.

[minus]

thx scuzzy,  the damn files have same signature is it a same person who realy well  hiding there the first one is the  acount admin at wanadoo , hard to beleve hi wil try to spam or send me a virus

second place is some PC shop ,

and more crap the virus is a ,,W32.Klez.E@mm It is a mass-mailing email worm that also attempts to copy itself to network shares. The worm uses random subject lines, message bodies, and attachment file names.

[Skuzzy]

minus, they both originated at wanadoo.fr.

I marked the IP address they originated from in the email header.

Return-Path:
Received: from satanas.europeonline.net ([194.177.33.67] verified)
  by mail01.europeonline.com (CommuniGate Pro SMTP 3.5.4)
  with ESMTP id 8274376 for 10940496@cgate.europeonline.com; Mon, 07 Apr 2003 21:54:08 +0200
Received: (from root@localhost)
   by satanas.europeonline.net (8.12.9/8.12.9) id h37Js7tw008152
   for 10940496@cgate.europeonline.com; Mon, 7 Apr 2003 21:54:07 +0200
Received: from mwinf0304.wanadoo.fr (smtp4.wanadoo.fr [193.252.22.28])
   by satanas.europeonline.net (8.12.9/8.12.9) with ESMTP id h37Jr5eN006978
   for ; Mon, 7 Apr 2003 21:53:06 +0200
Received: from Qjzkxcu (ANice-106-1-5-57.abo.wanadoo.fr [80.14.106.57])
   by mwinf0304.wanadoo.fr (SMTP Server) with SMTP id 5B1D8A802648
   for ; Mon,  7 Apr 2003 21:52:46 +0200 (CEST)
From: "facture.clients"
To: lvf01@europeonline.com
Subject: Done.
MIME-Version: 1.0
Content-Type: multipart/alternative;
   boundary=W4VC7y9N87


and the second
Return-Path:
Received: from satanas.europeonline.net ([194.177.33.67] verified)
  by mail01.europeonline.com (CommuniGate Pro SMTP 3.5.4)
  with ESMTP id 8333129 for 10940496@cgate.europeonline.com; Wed, 09 Apr 2003 19:50:45 +0200
Received: (from root@localhost)
   by satanas.europeonline.net (8.12.9/8.12.9) id h39HoiZn016076
   for 10940496@cgate.europeonline.com; Wed, 9 Apr 2003 19:50:44 +0200
Received: from mwinf0302.wanadoo.fr (smtp4.wanadoo.fr [193.252.22.28])
   by satanas.europeonline.net (8.12.9/8.12.9) with ESMTP id h39HneeN015348
   for ; Wed, 9 Apr 2003 19:49:41 +0200
Received: from Hifzcufob (ANice-106-1-8-98.abo.wanadoo.fr [81.49.131.98])
   by mwinf0302.wanadoo.fr (SMTP Server) with SMTP id D49D7C00065F
   for ; Wed,  9 Apr 2003 19:49:20 +0200 (CEST)
From: webmaster
To: lvf01@europeonline.com
Subject: A special  powful tool
MIME-Version: 1.0
Content-Type: multipart/alternative;
   boundary=OI4M09c4nr6A46JU648bb8l
Message-Id: <20030409174920.D49D7C00065F@mwinf0302.wanadoo.fr>
Date: Wed,  9 Apr 2003 19:49:20 +0200 (CEST)
X-Loop: forward.europeonline.com

[minus]

cleare !! now i copy, well must be some   frend who have it    this  frekin masmailer worm