Complete virus scans on my computer and at least one other member's computer show no viruses, and my Sent folder doesn't show that I have sent any of these emails.

This is the W32.klez.h@MM virus. I just spent 2 days at a company removing this virus from 30 machines. It is a real bear if the payload is executed. The most common side effect of this virus is it renames your .exe program files. For example at this company I went to, it renamed the .exe files for Norton Anti-Virus to a random named file, and also renamed their QuickBooks.exe file to a random name.

If the virus is on your machine, more than likely you will not be able to open your virus scan, but that is not always the case.

First and foremost...Download the latest virus definition file for your virus scanner. If you don't know how to do this please email me off the forum and I can walk you through it.

Then do a scan and it should pick the virus. If you can't open your virus scan application, please view the following link for instructions on how to manually remove this virus.
http://securityresponse.symantec.com/avcenter/venc/data/w32.klez.h@mm.html

WARNING* The manual removal of this virus is a little tricky and I would only recommend it if you are comfortable with the Operating System and have edited the Registry before.

If anyone is having problems with this virus you can contact me via email and I will set something up to help you out, be it a phone call or a email.

Thanks,
Mark

Yes, go ahead and delete them that are in your quarentine.

I recommend running all of your applications and see if all the .exe files run ok.

If any of you guys are having issues with any application, give me a email and I can walk you through it.

If you don't know how to do this, let me know.

Sorry, when @home went under I got a new email address and forgot to change my profile on the forum.

Send all emails to markardito@attbi.com

In Outlook Express, go to the 'View' menu and then scroll down to 'Layout'.

Then select 'Layout' and take the check mark out of "Show Preview Pane".

Click 'Apply' and then 'OK'.

Done!

thanks
wayne brown
c/o out west pac-seats

[This message was edited by Wayne Brown on 25 April 2002 at 04:01 PM.]

Klez worm rating upgraded as spread continues

The W32.Klez worm and its variants are still loose in the wild more than a week after the latest variant was discovered, moving antivirus software vendor Symantec Corp. to upgrade it to a "level 4 virus threat" on its danger scale of five.
http://computerworld.com/nlt/1%2C3590%2CNAV47_STO70574_NLTAM%2C00.html

[This message was edited by Jim Smith on 26 April 2002 at 09:55 AM.]

Return-Path:
Received: from rly-xd05.mx.aol.com (rly-xd05.mail.aol.com [172.20.105.170]) by air-xd03.mail.aol.com (v84.16) with ESMTP id MAILINXD34-0426124108; Fri, 26 Apr 2002 12:41:08 -0400
Received: from out016.verizon.net (out016pub.verizon.net [206.46.170.92]) by rly-xd05.mx.aol.com (v84.10) with ESMTP id MAILRELAYINXD57-0426124037; Fri, 26 Apr 2002 12:40:37 -0400
Received: from Vsosofue ([24.55.174.97]) by out016.verizon.net
(InterMail vM.5.01.04.05 201-253-122-122-105-20011231) with SMTP
id <20020426164023.IYXZ8115.out016.verizon.net@Vsosofue>
for ; Fri, 26 Apr 2002 11:40:23 -0500
From: joeyace
To: busgal58jb@aol.com
Subject: Language
MIME-Version: 1.0
Content-Type: multipart/alternative;
boundary=Zi0B1iyX9O1u
Message-Id: <20020426164023.IYXZ8115.out016.verizon.net@Vsosofue>
Date: Fri, 26 Apr 2002 11:40:32 -0500

There's a free removal tool for this virus at Symantec http://securityresponse.symantec.com/avcenter/venc/data/w32.klez.removal.tool.html

I keep protected with Norton AV and DO NOT open attachments.

Just to be sure, I downloaded and ran the tool in the above link. After about 30 min of examining my system it reported I had no infected files. Per their instructions, I ran it again. Still OK.

I suggest you do the same.

I regularly get attachments from suspicious addresses.

The best advice is
Do Not Open Any Attachments.

Hope you're OK.

-j0ey-

[This message was edited by Joey Ace on 26 April 2002 at 05:47 PM.]

Then use AVG virus checker from Grisoft - also free,

I did not recognize the addressee.
I deleted the e-mail immediately.
could this have been one of the ones everyone is getting ?
kf

All of you who are using a trial version or any kind of anti-virus software that isn't constantly updated are having a false sense of security. It may have done a great job of cleaning the virus off your computer, but what about the next new virus? C'mon guys, this is not the time to be cheap! Isn't your computer and all your data stored in it worth 20 bucks? After spending $1000 I'm sure Wayne thinks so!

If I may make a suggestion, whatever anti-virus method you're using, be sure you get the updates at least once a week. If you're not, then you're setting yourself up for another virus attack.

[This message was edited by Jim Phelps on 01 May 2002 at 07:50 AM.]

quote:

---

What's the advantage of renaming attachments, Colin?

Isn't a bug by any other name still a bug?

---

To the point, Zone Alarm doesn't rename the file titles, it renames the file extension. On Windoze and UNIX boxes, this prevents a file from launching the associated executable or script action.

For example, a file named "BadBoy.wsh" would normally launch the Windows Scripting Host. Renaming it to "BadBoy.xxx" would prevent it from launching by double-clicking. This is the technique Zone Alarm employs. I'm not on Windoze at the moment and I can't remember the actual extension ZA uses, but it starts with "z" and contains a number.

ZA doesn't rename all attachments, just those meeting its guidelines for suspicious files.

Also, as an aside, you should delete Windows Scripting Host from your machine. Unless you're coding in Visual Basic, you don't need it. And if for some reason you find out later you do need it, you can restore it easily.

WSH is a security hole large enough to drive a truck through. To delete it:

1. Select Start/Control Panels.
   
2. Double-click Add/Remove Programs.
   
3. Click the Windows Setup tab. A list of installed components displays.
   
4. Click Accessories to highlight it.
   
5. Click the Details... button.
   
6. Scroll down to locate Windows Scripting Host.
   
7. Click the checkbox to de-select WSH.
   
8. Click OK to save your change and close the window.
   
9. Click OK again to apply the change and close the control panel.

To restore WSH, simply reverse the procedure by enabling its checkbox in the Add/Remove Programs control panel.

[This message was edited by Jeff Agnew on 01 May 2002 at 07:49 AM.]

Run, don't walk, back to Staples and purchase that copy of Norton Antivirus version 2002. It will be the best $20 you spent on your computer.

quote:

---

they all told me you need to "throttle the Norton program back some"..

---

Norton products usually attempt to be all things to all people. As such, they are widely considered in the industry to be bloated and resource hogs.

As Jon noted, Crash Guard is a notoriously unstable component and most techies suggest uninstalling it. When they speak of "throttling Norton back" they are referring to removing all but the most stable and necessary components. You can do this with your installation CD. You really only need Disk Doctor. Others can run from CD, such as Speed Disk.

The problem with SystemWorks is that if you also use Norton AntiVirus it tries to integrate that under the same common controls, as well.

One of the best-performing AV programs available is Kaspersky Antivirus. It updates your virus definitions *daily*. My only complaint is that renewing the license annually is expensive. Also, the interface is a bit obtuse.

You might give AVG a try on your system. It's reasonably lean on system resources, has an intuitive, simple interface, is updated with definitions regularly, and the company will optionally send you a warning e-mail when a nasty virus is making the rounds (like Klez recently). Best of all, it's free.

I have tried those Norton System products and have not liked them very much. I have come to the conclusion that sometimes they do more harm than good. I still use good old "Disk Defrag" and "Scan Disk" from windows. For machines that I have Win98/95 and Me I use a program called spinrite from Steve Gibson. http://www.grc.com

The only downfall about spinrite is that on a 20GB hard drive it will take around 28 hours!!!! Yep that's right, 28 hours!!!

Here are the pro's and con's of the Antivirus Software I have found.

McAfee - You purchase version 6.x and as long as you register your copy, you get a lifetime subscription of updates. It also AUTOMATICALLY updates while you are connected to the internet. You don't even know it is happening.

Norton Antivirus - You purchase version 2002 and if you register your copy you only get a 1 year subscription to updates. You will have to submit a credit card to renew your subscription.

PLEASE NOTE - I am not sure that Norton 2002 has this 1 year subscription thing. I know 2001 did. Maybe some Norton 2002 users can step in here.

Norton 2002 is VERY user friendly. McAfee is not so 'nice' looking and sometimes leaves you guessing what you should do. Where as Norton pretty much holds you by the hand.

Both of them are very reputable companies who have excellent products.

Steve Feldmen has brought to my attention a product called "PC - Cillin" I am not familiar with it, but he likes their AntiVirus program.

I use McAfee, but I would recommend Norton for someone who feels uneasy with some computer decissions.

Mark

quote:

---

The subject line, message bodies, and attachment file names are random. The From address is randomly-chosen from email addresses that the worm finds on the infected computer.

---

I've been getting emails from people saying that they couldn't run the attachment I sent them. I am not infected, and I never sent them anything!

Lately about 20% of my inbox is this virus. I'm in a lot of address books!

------------------
               Bobby Lee
-b0b-   quasar@b0b.com
-System Administrator

[This message was edited by b0b on 02 May 2002 at 08:15 AM.]