Klez virus

K

kwick6

Donating Member
I have been getting a few emails from syty people, various email addresses.
It has been confirmed to be this klez virus, and if you click on the link here you can find out if your computer has it. Just click on this..

http://securityresponse.symantec.com/avcenter/venc/data/w32.klez.removal.tool.html

Scroll down to "To obtain and run the tool", click on link to download.

I ran this yesterday, and it was not detected on my computer.
It doesn't take long to run it.

Here is some info to help explain...

Email spoofing
Some variants of this worm use a technique known as "spoofing." If so, the worm randomly selects an address that it finds on an infected computer. It uses this address as the "From" address that it uses when it performs its mass-mailing routine. Numerous cases have been reported in which users of uninfected computers received complaints that they sent an infected message to someone else.

For example, Linda Anderson is using a computer that is infected with W32.Klez.E@mm; Linda is not using an antivirus program or does not have current virus definitions. When W32.Klez.gen@mm performs its emailing routine, it finds the email address of Harold Logan. It inserts Harold's email address into the "From" portion of an infected message that it then sends to Janet Bishop. Janet then contacts Harold and complains that he sent her an infected message, but when Harold scans his computer, Norton AntiVirus does not find anything--as would be expected--because his computer is not infected.

If you are using a current version of Norton AntiVirus and you have the most recent virus definitions, and a full system scan with Norton AntiVirus set to scan all files does not find anything, you can be confident that your computer is not infected with this worm.

Thanks,
Scott
 
ParTyBoy

ParTyBoy

New member
Re: Klez virus

kwick6 said:
I have been getting a few emails from syty people, various email addresses.
It has been confirmed to be this klez virus, and if you click on the link here you can find out if your computer has it. Just click on this..

http://securityresponse.symantec.com/avcenter/venc/data/w32.klez.removal.tool.html

Scroll down to "To obtain and run the tool", click on link to download.

I ran this yesterday, and it was not detected on my computer.
It doesn't take long to run it.

Here is some info to help explain...

Email spoofing
Some variants of this worm use a technique known as "spoofing." If so, the worm randomly selects an address that it finds on an infected computer. It uses this address as the "From" address that it uses when it performs its mass-mailing routine. Numerous cases have been reported in which users of uninfected computers received complaints that they sent an infected message to someone else.

For example, Linda Anderson is using a computer that is infected with W32.Klez.E@mm; Linda is not using an antivirus program or does not have current virus definitions. When W32.Klez.gen@mm performs its emailing routine, it finds the email address of Harold Logan. It inserts Harold's email address into the "From" portion of an infected message that it then sends to Janet Bishop. Janet then contacts Harold and complains that he sent her an infected message, but when Harold scans his computer, Norton AntiVirus does not find anything--as would be expected--because his computer is not infected.

If you are using a current version of Norton AntiVirus and you have the most recent virus definitions, and a full system scan with Norton AntiVirus set to scan all files does not find anything, you can be confident that your computer is not infected with this worm.

Thanks,
Scott
Click to expand...

Thanks for the info.. hadn't actually gotten around to looking at this yet..
 
ParTyBoy

ParTyBoy

New member
Phoon30 said:
Is this "Klez" virus something that the newest version of Norton will find?
Click to expand...

If norton is infected it will cause norton to cease functioning or work properly... I don't think norton can detect it because klez effects the registry as well as system restore ... You need to disable system restore & run the klez cleaner program in safe mode.
 
K

kwick6

Donating Member
Correct me if I'm wrong here.
If you scan your system with that link I posted. It will tell you whether or not you have the virus, period.
Once you've done that, Norton will then alert you of any incoming emails that contain the virus. In fact, Norton alerted me yesterday of 3 incoming emails that had the virus. I put it in quarantine, then I just deleted it.
If you go into Norton, you can select certain options, I just use all the recommended ones. Then if I get alerted I just go into Norton and delete whatever it captured thats in quarantine. Whatever is in your email box associated with what Norton has identified as carring the virus is safe for you to just delete, because Norton has taken the virus out of it.

Thats how I understand it, but I could be way off, I'm new.

Scott
 
O

Opleezz

Member
No your pretty close to right on that one, I have been receiving emails for about the past 2 weeks with this virus attached, a few from some syty people, Norton 2002 picks them up before I open my mail up, I have probably got around 20 emails from various people with it. If you go to http://www.sarc.com/ it’s the root page for that other site, it tells you about all the new ones.
 
ParTyBoy

ParTyBoy

New member
kwick6 said:
Correct me if I'm wrong here.
If you scan your system with that link I posted. It will tell you whether or not you have the virus, period.
Once you've done that, Norton will then alert you of any incoming emails that contain the virus. In fact, Norton alerted me yesterday of 3 incoming emails that had the virus. I put it in quarantine, then I just deleted it.
If you go into Norton, you can select certain options, I just use all the recommended ones. Then if I get alerted I just go into Norton and delete whatever it captured thats in quarantine. Whatever is in your email box associated with what Norton has identified as carring the virus is safe for you to just delete, because Norton has taken the virus out of it.

Thats how I understand it, but I could be way off, I'm new.

Scott
Click to expand...

I could be wrong, but that link you posted leads to symantec's page on how to download the tool & the steps you take to use it... I didn't see any links on the page related to a direct scan of your computer from symantec..
Only a downloadable program.... Please correct me if I'm blind 8) :lol: It happens.... :eek:
 
G

GM TURBO

Sell Out
I am sure most of you know this - but I will throw this out in an attempt to help those who aren't quite as computer savy.

Just because you have the latest version of a virus protection program doesn't mean you won't get one. There are a few other things that some into play. All companies that produce the software will have updates. Some computers are set up to get these "Live Updates" at certain times. Some are not. Some you have to do it manually. Some you will have a link you can click on from your desktop. Depending on how obsessive you want to be - you can check for updates everyday - everyweek - or whenever you want. People are creating new viruses all the time. And others send them out without knowing about it.

Just something to think about.
 
You must log in or register to reply here.
Top