Theos-Talk Archives (March 2003 Message tt00017)

Dear Dallas,

The virus-worm attached letter I received might not have come from you 
(unless your antivirus program has not yet been updated with the Klez.E worm 
detection code and your e-mail program is infected without your knowledge). 
Although, your address was used as the return address. If your PC mail 
program is infected, this worm actually sits there permanently, and besides 
doing other damage, it sends out replicas of itself (such as the letter I 
received) to everyone on your mailing list.

The message and attachment, however, seemed not to be consistent with your 
previous mailings. That's why I checked it out. 

I also found out that some spammers are able to use our home addresses for 
their e-mail return addresses. They pick these addresses up from monitoring 
e-mail lists and chat rooms. It's a security problem on the Internet, and 
with certain mail programs -- that hackers have been able to penetrate. This 
could be the case, if your e-mail program was not infected. I had previously 
received some spam letters with my own home address listed as the return 
address in the "From" box. That's what made me suspicious when the virus 
containing letter came in along with its strange message and with your return 
address on it.

Consequently, it good advice to be cautious of all mail that comes from 
people you know from chat rooms or e-mail lists that look like spam and or 
have unsolicited attachments. 

Even if you do download an attachment from someone you know, make sure it is 
checked by an anti virus program that has been updated with the latest 
virus/trojan horse/worm detection information. Such updates should be 
downloaded from the web monthly from your virus program vendor (unless the 
program has an automatic update feature built in). 

In your case, Dallas, I suggest you check with Norton/Semantec and find out 
if your anti virus program is able to detect the Klez.E worm. If not, I 
recommend you download their latest antivirus updates. For instructions 
related to this worm, go to:
http://securityresponse.symantec.com/avcenter/venc/data/w32.klez.e@mm.html

(BTW, this worm does not infect Macintosh computers.) 

Leon


In a message dated 03/02/03 7:18:41 AM, dalval14@earthlink.net writes:

>Dear Leon:
>
>dalval14 @ earthlink.net is my E-mail address.
>
>All mail in and out is virus screened by NORTON SEMANTEC and I
>re-checked for viruses and was told my files are clean.
>
>Also I have sent no files with "attachments."
>
>I have no idea how this has happened.
>
>Dal

-----Original Message-----
From: LeonMaurer@aol.com [mailto:LeonMaurer@aol.com]
Sent: Saturday, March 01, 2003 10:07 PM
To: Theosophy Study List
Subject: Worm Klez.E immunity - WARNING

WARNING:
The following note along with an attached file was sent to me using the
return address of someone on this forum. (dalval14@earthlink.net)

If you get this letter, DO NOT download the file.

According to Mcaffey, this is a hoax mail and a trick to install the worm on
Windows machines. For a complete rundown on this worm, see:
http://vil.mcafee.com/dispVirus.asp?virus_k=99455

----- original message--------

"Klez.E is the most common world-wide spreading worm. It's very
dangerous by corrupting your files. Because of its very smart stealth and
anti-anti-virus technicmost common AV software can't detect or clean it.
We developed this free immunity tool to defeat the malicious virus. 
You only need to run this tool once,and then Klez will never come 
into your PC.
NOTE: Because this tool acts as a fake Klez to fool the real worm,some AV
monitor maybe cry when you run it. If so,Ignore the warning,and select
'continue'. If you have any question,please mail to me. "

---