I have been getting a lot of emails from the AR15.com server saying I have been sending my fellow board members an email virus.  I wanted you and everyone to know that this is NOT the case.  I checked with my provider, and someone is sending them with or without knowing it, from their infected computer, and spoofing my email address. I just got the same email from another member.  Please let all members know to check their email programs and computer for this virus.  My system is virus-free.  I have sent an email to only a handful of board members, and NEVER to the AR15.com address.  

Thanks.  The following emeail is from my provider explaining the virus, and how it works.





Dear Alan **********,

Thank you for contacting us.

This sounds like a person who has your email address has been infected with the KLEZ virus. This W32/Klez variant has the ability to spoof the email FROM: field. The senders address used by the virus, may be one that was found on the infected user's system. Thus, it may appear that you have received this virus from one person, when it was actually sent from a different user's system. Viewing the entire email header will display the actual senders address.

This worm makes use of Incorrect MIME Header Can Cause IE to Execute E-mail Attachment vulnerability http://www.microsoft.com/technet/treeview/default.asp?url=/technet/security/bulletin/MS01-020.asp in Microsoft Internet Explorer (ver 5.01 or 5.5 without SP2)

This worm arrives in an Email message with a subject and body randomly composed from a rather long pool of strings that the virus carries inside itself (the virus can also add other strings):
To learn more about the KLEZ virus. Please go to;

http://vil.nai.com/vil/content/v_99367.htm

You can also learn more about viruses by going to:

https://www.getvirushelp.com/


We have further information about Internet access through EarthLink at our customer support site:

http://support.earthlink.net

(Also accessible from the "Support" link on the top right of your Personal Start Page.)

If you need further assistance you can also contact us via chat at:

http://support.earthlink.net/chat 7 a.m. to 2:45 a.m. (EST) 7 days a week.


Harry J.
Electronic  Support                    
EarthLink, Inc.
The #1 Provider of the Real Internet
CSR ID#: 1051

Case ID 12240729

I got the same message from the AR15 server also. I too have contacted my provider, utilized Norton AV, and the Klez removal tool all to no avail. My ISP also believes my Email is being spoofed. I too have never used or emailed anybody with an @ar15.com address. You are not alone