[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Klez keeps worming around



I haven't been able to follow the list much this past week or so.  How 
strange to find that my email address has been participating without me.

The Klez worm is obviously at work.  Folks who use Windows and have my 
email in their address books should scan for viruses -- it wouldn't be a 
bad idea for everyone to do so.  Also, I've had Klez knocking on my door in 
concert with the "grendel" posts to this list.  I've received two binary 
attachments and both contained the W32.Klez.H@mm variant of the worm.

One binary was named "target.exe" and the other was named 
"height.pif".  The latter also contained the message "This is a good tool I 
hope you would like it" in the body.  Both messages were "sent" by 
Aquatic-Plants (this list).  Actwin was not the actual sender, of course, 
but this could easily dupe someone not computer savvy or familiar with the 
tactics of the worm into activating the code and infecting their system.

The moral of the story is:  Don't EVER open an attachment without scanning 
it first even if you recognize the sender.

Sorry for the OT, but perhaps it will help get Klez off this list once and 
for all.  In closing, here's a couple of links for those without an 
antivirus utility:

Get a free scan here:
http://housecall.antivirus.com

If you have Klez operating on your system, you can try to remove it with 
this tool:
http://securityresponse.symantec.com/avcenter/venc/data/w32.klez.removal.tool.html

Alternatively, you can download a trial version of a good utility like 
Symantec's or McAfee's.

Thanks.
--
Chuck Huffine
Knoxville, Tennessee