Posted on 04/24/2002 11:41:24 PM PDT by JohnHuang2
If you're seeing a sudden surge in the amount of e-mail in your inbox, chances are it has little do with your popularity.
Delete buttons on personal computers are getting a workout this week thanks to a tricky e-mail worm tunneling across America and the rest of the world.
Known as "Klez," the worm has been bombarding mailboxes with unsolicited messages, replicating itself and changing its own appearance by displaying a variety of subjects and senders.
"It's a worm that spreads really quickly," said Sharon Ruckman, senior director for anti-virus software maker Symantec's security response team. "And it carries an additional payload that can do some damage."
That additional payload is a virus known as "Elkern," which tries to infect other systems by sharing information. When combined with Klez, the two create problems that go beyond large amounts of incoming mail.
"It can release confidential information on your system which is never a good thing to have happen," Ruckman told WorldNetDaily. "It also has the ability to remove anti-virus software."
Klez is more deceptive than some previous problem e-mails, as it has a wide variety of titles displayed in the subject line, and can latch on to an e-mail address of someone a user knows and insert it in the "From" field, making users more apt to open it and thus get infected.
Some of the titles listed in infected mails include:
Klez also uses some combinations of random words in subject lines, to make it even more confusing. The random words include:
Some messages even appear to be trying to help PC users by offering a patch or removal tool for Klez or Elkern, but are nothing more than the worm itself.
"They're trying to get people to open it," Ruckman said regarding the virus writers' clever deception skills. She adds her company does not e-mail people randomly with removal tools.
Symantec has ranked Klez at a category 3 medium risk on a scale of 1 to 5, with 5 being the most dangerous.
"That means it's spreading in the wild more quickly, but it's not as serious as [other viruses like] Melissa or LoveBug," Ruckman said. She also says the Nimda virus which debuted last year is still problematic.
According to anti-virus software maker Trend Micro's world virus tracking center, Elkern and Klez are currently the top two ranked viruses. In the past 24 hours, they are estimated to have infected over 400,000 files globally.
Several strategies can be employed in preventing computers from being infected. Home PC users should avoid opening the messages and delete e-mails with attachments, especially if something appears strange in the subject or sender's line.
"Don't be curious about e-mail," Ruckman said. "Just delete it." Once deleted, users should also empty their trash bins.
She also recommends having anti-virus software on your machine, plus the "latest and greatest software patches," which can be downloaded from Microsoft.
Corporate e-mail users can have their system administrators attack the problem by filtering out certain attachments and subject lines at the gateway of their mail servers.
If a computer has been infected, free removal tools are available from both Symantec and Trend Micro.
But despite assurances from anti-virus companies, some organizations like ACT Teleconferencing in Hong Kong are having trouble curing the problem.
"Irrespective of what Symantec or other vendors say, there has been no way to stop this worm in the short term," Bob Deverell of ACT told the South China Morning Post this week.
"We have been struggling to clean our machines," he said. "We haven't been able to stop it and we're very competent."
Yup, it's what I used and ran it 4 times for good measure.
I don't have a 'preview' pane in 'view'
I'm using OE6.
wassup?
Download the latest NAV virus definitions and then run NAV again. I bet if will show the 'Klez' virus is infecting your computer. Best to do a NAV scan from the emergency boot disk after the windows-based NAV scan just to make sure it really is completely gone. Otherwise follow the instructions in my FReepmail.
NoFileUrl NoFolderOptions NoChangeStartMenu NoWindowsUpdate NoSetActiveDesktop NoForgetSoftwareUpdate NoMSAppLogo5ChannelNotify ForceCopyACLWithFile NoResolveTrack NoResolveSearch NoEditingComponents NoMovingBands NoCloseDragDropBands NoClosingComponents NoDeletingComponents NoAddingComponents NoComponents NoChangingWallPaper NoHTMLWallPaper ActiveDesktop NoCustomizeWebView ClassicShell ClearRecentDocsOnExit NoFavoritesMenu NoActiveDesktopChanges NoActiveDesktop NoRecentDocsMenu NoRecentDocsHistory NoInternetIcon NoSettingsWizards NoLogoff NoNetConnectDisconnect NoViewContextMenu NoTrayContextMenu NoWebMenu LinkResolveIgnoreLinkInfo NoCommonGroups EnforceShellExtensionSecurity NoRealMode WinOldApp MyDocsOnNet NoStartMenuSubFolders NoAddPrinter NoDeletePrinter NoPrinterTabs RestrictRun NoStartBanner NoNetHood NoDriveTypeAutoRun NoDriveAutoRun NoDrives NoFind NoDesktop NoSetTaskbar NoSetFolders NoFileMenu NoSaveSettings NoClose NoRun
diotima, hopefully NAV can save most of your data and wipe this filth from your machine.
Also, it would not let me install any anti-virus programs. Ate them as soon as I tried install them. I was at the point that I was ready to find magnet and run it over the hard drive and then take it out and shoot it. Put it out of my misery. I have had a very short fuse for the last two days.
The only thing that has worked was the Symantec link above. It was in my registry. I can't access my email program. It is a very virulent nasty bug.
It has mess with a lot of stuff in my 'puter and I can't access several things right now, but the bug is gone (fingers crossed, knock on wood, and several thousand prayers), I hope for good.
Disclaimer: Opinions posted on Free Republic are those of the individual posters and do not necessarily represent the opinion of Free Republic or its management. All materials posted herein are protected by copyright law and the exemption for fair use of copyrighted works.