Replying to LO28140 --
Another variant of the virus... Appears in a message claiming to be a
virus solution... Sorry to be harping on this, but this one is extremely
dangerous because you might receive virus-laden msgs which _appear_ to
have come from me or someone else you trust.
Here's the msg I received today... I believe the msg is completely bogus
and that it carried the virus, not a solution. Fortunately, the outbound
mail system was screening for viruses and eliminated it before sending.
The "NOTE" in the message is a thinly disguised attempt at hiding the
virus itself.
>From: DELETED <DELETED@DOES_NOT_MATTER.COM>
>To: Richard@Karash.com
>Subject: Worm Klez.E immunity
>Date: Wed, 1 May 2002 16:16:32 -0400
>Content-Type: text/html;
>
>Klez.E is the most common world-wide spreading worm.It's very
>dangerous by corrupting your files.
>Because of its very smart stealth and anti-anti-virus technic,most
>common AV software can't detect or clean it.
>We developed this free immunity tool to defeat the malicious virus.
>You only need to run this tool once,and then Klez will never come
>into your PC.
>NOTE: Because this tool acts as a fake Klez to fool the real
>worm,some AV monitor maybe cry when you run it.
>If so,Ignore the warning,and select 'continue'.
>If you have any question,please mail to me.
I recently wrote in part:
>Here is information on the virus I'm worried about right now:
>
> http://securityresponse.symantec.com/avcenter/venc/data/w32.klez.e@mm.html
>
>That page includes this warning: "Because this worm does use a randomly
>chosen address that it finds on an infected computer as the "From:"
>address, numerous cases have been reported in which users of uninfected
>computers receive complaints that they have sent an infected message to
>someone else."
>
>I recommend:
> - Do use a virus protection program and keep it up to date
> - Do not use Outlook (This virus propagates even from the preview window!)
> - Do not double click attachments unless you have virus-checked them first
> - Do not open messages that look suspicious
...snip...
--Richard Karash ("Rick") | <http://world.std.com/~rkarash> Speaker, Facilitator, Trainer | mailto:Richard@Karash.com "Towards learning organizations" | Host for Learning-Org Discussion (617)227-0106, fax (617)523-3839 | <http://www.learning-org.com>
Learning-org -- Hosted by Rick Karash <Richard@Karash.com> Public Dialog on Learning Organizations -- <http://www.learning-org.com>
"Learning-org" and the format of our message identifiers (LO1234, etc.) are trademarks of Richard Karash.