Who left the dimensional door open? - Thread 007

News Center (Online) ^ | 1/29/02 | Unknown

[tomkat]

that'd be a pretty good guess, ma'am ...

you running any a/v ?

[Neets]

Nope..sir...don't have any installed on my puter........

[palo verde]

hi neets
she is shining in my window now
she sure is a beauty
Love, Palo

[Neets]

Sun is shinning here Palo...for a little while anyway...rain later this afternoon/evening.

[grannie9]

Neets .. I haven't sent you any emails. It might look like its from anyone.. if it's exe .. delete it.

[palo verde]

and tomkat is kinder than Gary Cooper

[tomkat]

oops !
well, 'bout the first time you lose all your shit, you might wanna think about spending $30 and gettin' Norton...

in the meantime, run that tool i linked and it should find it if it's there.

[Neets]

ok, i'm good then...I haven't opened any exe files...never do....

[Neets]

Okie dokie pokie......thanks tooooooooooooooo

[tomkat]

until you deal with this,

turn 'auto-preview' OFF in your email app !

as far as i can tell, only Outlook and Outlook Express are vulnerable to this virus

[Neets]

I have AOhelL.....

[palo verde]

I have outlook express
I'll look to turn that thing off
hope I can find it
thanks tommy
Love, Palo

[tomkat]

I have AOhelL.....

well then, you were toast to start with

[Neets]

HEHEHEHE no shit sherlock!!!!!!!!! it bites huge you know what

[tomkat]

palo, in OE, click (on the menu bar) ...

View / Layout

down toward the bottom, clear the box labelled 'Show preview pane'

[tomkat]

W32.Klez.gen@mm

Discovered on: November 9, 2001

Last Updated on: April 26, 2002 at 04:26:45 PM PDT

Due to an increased number of submissions, this threat has been upgraded to Category 4.

W32.Klez.gen@mm is a generic detection that detects variants of W32.Klez. Computers that are infected with W32.Klez.gen@mm are most likely infected with either W32.Klez.E@mm or W32.Klez.H@mm. Please refer to the appropriate write-ups for more information.

Removal tool
Symantec has provided a tool to remove infections of W32.Klez.E@mm, W32.Klez.H@mm, W32.ElKern.3587, and W32.ElKern.4926. If your computer is detected as infected with W32.Klez.gen@mm, download and run the tool. In most case, the tool will be able to remove the infection. Click here to obtain the tool.

This is the easiest way to remove these threats and should be tried first.

Type: Virus, Worm
Infection Length: Varies

• Virus Definitions (Intelligent Updater)*

November 9, 2001

• Virus Definitions (LiveUpdate™)**

November 9, 2001

*	Intelligent Updater virus definitions are released daily, but require manual download and installation. Click here to download manually.
**	LiveUpdate virus definitions are usually released every Wednesday. Click here for instructions on using LiveUpdate.

Wild:

• Number of infections: More than 1000
• Number of sites: More than 10
• Geographical distribution: Medium
• Threat containment: Moderate
• Removal: Difficult

Threat Metrics
Wild: Medium			Damage: Medium			Distribution: High

Damage:

• Payload: Infects the system with the W32.ElKern.3326 virus.
  • Large scale e-mailing: Emails to addresses found in the address book.

Distribution:

• Subject of email: Random subject
• Name of attachment: Random attachment with .BAT, .EXE, .PIF or .SCR extension
• Size of attachment: approximately 60KB
• Shared drives: Infects shared and mapped drives

W32.Klez.gen@mm is a mass-mailing worm that searches the Windows address book for email addresses and sends messages to all recipients that it finds. The worm uses its own SMTP engine to send the messages.

The subject and attachment name of incoming emails is randomly chosen. The attachment will have one of the following extensions: .bat, .exe, .pif or .scr.

The worm exploits a vulnerability in Microsoft Outlook and Outlook Express in an attempt to execute itself when you open or even preview the message. Information and a patch for the vulnerability can be found at

http://www.microsoft.com/technet/security/bulletin/MS01-020.asp.

W32.Klez.gen@mm attempts to copy itself to all network shared drives that it finds.

Depending on which variant of the worm, the worm will drop one of the following viruses:

• W32.Elkern.3326
• W32.Elkern.3587
• W32.Elkern.4926

which will then infect the system.

[acnielsen guy]

Serious Worm Warning

It seems that we may have a virus W32/Klez or actually a worm that is using e-mail address books to propagate itself. Be very careful of opening your email even if you know the person – check the extension

I just got two one with an .exe extension coming from one person with a different return address. It will disable you anti-virus databases among other things. You may get returned mail that you did not send as it seems to send from one computer and have a return path to another.

Some people are getting 15 emails returned that they did not send.

[palo verde]

first bird chirped
huge full Moon still in my window
first light in East

[palo verde]

thank you tommy, I am on way to do it now
(I love you)

[palo verde]

I am getting tons of email returned that I did not send