JT READ THIS

LB

Your e-mail address is sending out a virus. the [email protected] address. Please get rid of that one and close it down. Do what is needed as many others have gotten a virus from you.

bikerchic

coff,coff!

bc I hate those damn virus's....ahhhhhchooo

Dutchie

LB, I got a wicked virus from that email address and opened it because I thought I recognized the address. The virus absolutely fried my hard drive. Had to get another computer.

Thanks.

Closing down that email address wont do any good. Email-borne viruses will use whatever your default mailbox is to propagate. If JT is infected then he needs to clean his computer of the virus, not change email addresses.

LB, if you post the subject, message, and any attachments of these emails (might also be a good idea to take a look at the email headers, as many of them spoof coming from a different sender) then it should be no problem figuring out which virus/trojan/worm is being sent to you.

JT, assuming it is your computer sending these viruses, do you have any antivirus software (e.g. Norton or McAfee) installed on your computer? If so, make sure they have their version of real-time monitoring running. It takes up memory (RAM) on your computer, but you need the protection.

Dutchie, I guess it's a little late now, but you should NEVER open email with an attachment--even if you are certain you know the sender--unless they contacted you ahead of time and said an attachment was on its way.

Hmmm

JT

DONE DEAL-

THANKS

Valis

It may not be his machine that is infected either. it could be possible that his email address has been culled from someone else's address book and propagated by the virus as the sender to other people. Just a thought. Any of you other members of the "tech support" class know if this is possible?

Sincerely,

District Overbeer

mustang

I got JT's address, Amazing's and a few others in several Emails about 6 weeks ago. I definitely saw JT/Amazing addresses in the same email session. I sent this into Hotmail service and they informed me that the KLEZ virus had hijacked an address book.

This was a few days ahead of our IS shutting down almost all EXTERNAL services. I saw other addresses I recognized from different Web communities. There were at least three waves of this, separated by about a week at a time. I have had our European branch stop suspect emails, also. This thing is WORLD-WIDE, WEB-WIDE, adn probably not a JW thing. Only this week have our services been re-opened.

In the case of a hijacked address book, the person named as the ADDRESSOR may be innocent, safe and unaware of all this.

Mustang

LB

Good deal JT. Those things suck.

Jourles

Just to set the record on this worm/virus:

1. It can only infect a computer that is running Win98/Me or 2k/XP. If you have 95 or NT, Mac, or Linux, you're ok.

2. It CANNOT infect or replicate through a web-based email system such as Hotmail or Yahoo. In most simplistic terms, Klez only affects Microsoft Outlook and Express. Only if you download and manage to execute this virus from a web-based email system will you infect your Windows computer.

If someone is receiving a virus email from a known poster on this forum, AND it appears to come from a web-based email box such as [email protected] or [email protected], there is only one of three possibilities happening. First is, the real owner of the mailbox is deliberately spreading virii. That would be very very stupid. Secondly, their email account has been compromised by a guessed password OR their password was sniffed off a network, keyboard capture, etc. Many ways to get a password, even a peek over your shoulder when you are not looking. Third and most likely, the email address was spoofed. This is the simplest way of deceiving an intended recipient with a mailbourne virus. The recipient thinks that they are getting a legit email from a friend, but when they double-click on the "fun game" file "whack-a-mole.exe" they get to play the game, but they also get a trojan installed in the background, thus opening a back door into their entire computer.

Spoofing is very simple to do. And to easily hide his tracks, a good spoofer will use/find an email server that allows relaying. So even if you know how to decifer email headers, it won't mean anything because the originating IP address will appear to come from the open relay mail server, NOT the real spoofers IP address. There are ways to stop email coming from mail servers that allow relaying, but that is another topic in of itself.

Edited by - Jourles on 26 September 2002 18:48:55

Jourles

One more thing. You'll know that your a victim of Klez if you have an antivirus program installed and it automatically runs everytime you start up, BUT, for some unknown reason, you do not see it running. Whenever you try to start it up, it shuts down right away. When you try to install an antivirus program, it won't complete the installation. If this is happening to you, go here for instructions on how to fix this if you have the Klez -- http://securityresponse.symantec.com/avcenter/venc/data/w32.klez.removal.tool.html

JT READ THIS

Share this