[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index][Subject Index][Author Index]
RE: Possible Virus --> Re: Sos!
Regarding the virus:
Norton AntiVirus 2002 reports that it is the KLEZ virus.
I emailed Josh, and he did NOT send any email to the Dinosaur Mailing
Here is information about the virus (from Symantec):
W32.Klez.gen@mm is a mass-mailing worm that searches the
Windows address book for email addresses and sends messages to
all recipients that it finds. The worm uses its own SMTP engine
The subject and attachment name of incoming emails is randomly
chosen. The attachment will have one of the following
.bat, .exe, .pif or .scr.
The worm exploits a vulnerability in Microsoft Outlook and
Express in an attempt to execute itself when you open or even
preview the message. Information and a patch for the
vulnerability can be found at
W32.Klez.gen@mm attempts to copy itself to all network shared
that it finds.
Depending on which variant of the worm, the worm will drop one
the following viruses:
which will then infect the system.
Some variants of this worm use a technique known as "spoofing."
does this, it chooses at random an address that it finds on an
infected computer as the "From:" address that it uses when it
mass-mailing routine. Numerous cases have been reported in which
users of uninfected computers receive complaints that they have
sent an infected message to someone else.
For example, Linda Anderson is using a computer that is infected
with W32.Klez.E@mm; Linda is not using a antivirus program or does
have current virus definitions. When W32.Klez.gen@mm performs
its emailing routine, it finds the email address of Harold Logan. It
inserts Harold's email address into the "From:" line of an
infected email that
it then sends to Janet Bishop. Janet then contacts Harold and
that he sent her infected email, but when Harold scans his
Norton AntiVirus does not find anything--as would be
his computer is not infected.
If you are using a current version of Norton AntiVirus, have the
recent virus definitions, and a full system scan with Norton
set to scan all files does not find anything, you can be
your computer is not infected with this worm.
Someone, somewhere, who has the DML as an address in their address book
is infected with this virus. Possibly more than one person.
From: firstname.lastname@example.org [mailto:email@example.com] On Behalf
Of David Marjanovic
Sent: Tuesday, April 30, 2002 2:15 PM
Subject: Re: Possible Virus --> Re: Sos!
> Our mail server whacked this, claiming "Stats.scr" is a possible
Norton Antivirus, updated a few days ago, immediately stroke and
to repair the infected file.