Important information on the Klez virus (worm)

[PamelaP]

This sticky is intended to provide more information about the Klez virus (really a "worm") that has been making the rounds amongst VFers recently.

Please be assured that VF is not being targeted in any way and there is no "address book" or mailing list on VF that has been infiltrated or compromised. Klez has been around for several months and has proven to be very difficult to combat because it sends out emails using an alias or "spoofed" address. Any emails you receive are not REALLY from the person they say they are, so it does not mean that person's computer is infected. Klez does not affect Macintosh users.

Very helpful articles about the Klez virus/worm:
http://www.wired.com/news/technology...,52055,00.html
http://www.wired.com/news/technology...,52174,00.html

If you do not have virus protection software loaded on your computer, please consider purchasing one of the two well-known brands:
Norton AntiVirus: http://www.symantec.com/nav/nav_9xnt/ (30-day trial available)
McAfee VirusScan: http://mcafee.digitalriver.com/dr/v2...CACHE_ID=55633

To check for Windows security updates for your system:
http://v4.windowsupdate.microsoft.com/en/default.asp

Sample subject lines to watch for:

A very funny website
A very excite game
Noresize
Onmouseover
Here to learn more
Sos!
So cool a flash enjoy it
Japanese lass' sexy pictures
How are you
Let's be friends
Darling
Don't drink too much
Your password
Honey
Some questions
Please try again
Welcome to my hometown
the Garden of Eden
introduction on ADSL
Meeting notice
Questionnaire
Congratulations
japanese girl VS playboy
Look,my beautiful girl friend
Eager to see you
Spice girls' vocal concert

Klez also seems to be able to lift subject lines from the text of other emails, so sometimes you may see fitness/VF-related subject lines. Several VFers have reported receiving infected emails with Collage Video in the subject line. I've also seen emails with addresses, copyrights, nonsensical half-sentences, etc. in the subject line.

If you do receive such an email, do not open the email or the attachment. If you typically do not receive any emails with attachments, you might want to consider setting up your filters to send all emails with attachments to your Trash folder.

In addition, Klez will also sometimes send itself as a "returned mail" notification or an email claiming to FIX the problem. Don't open these either!

If there is any other information about this virus/worm I haven't covered that you would find helpful, please send me a PM and I will look into it.

PamelaP
VF Moderator

[PamelaP]

Just thought of some more info that may be helpful. The file size on these emails is usually about 110-130k, so that's one way to recognize them.

Also if you are receiving an email from a "spoofed" address, the "from" field will show the first part of the "sender's" email address, rather than their real alias.

For example, a real email received from my main account would say you're receiving it from Pamela P., because that's how I have my alias set up. However, if you receive one of these viruses from me (which isn't REALLY from me ), it will say it's from "tivoli" because that's the first part of my email address (before the @ sign).

[KarenP]

Originally posted by PamelaP
Klez does not affect Macintosh users.

But Mac users can still receive these annoying e-mails. Sigh.

[Reg]

I just got infected yesterday. *$&%*$ Man, why can't fixing these things ever be easy?

[Renee D]

I get Klezed on a daily basis (the price of belonging to a number of listservs.) Thank goodness for Norton Anti-virus! Yes, it makes the computer run slower, but that's better than not running at all!