Discussion Locked

How do I delete Klez completely

0 helpful
9 replies
Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.
How do I remove the Klez virus completely from my system. I have Norton Anti-virus installed on all machines on the network, and yesterday, I ran the Klez removal tool on all machines. However, today, the same emails associated with the virus are still re-appearing. How do I remove the virus and stop receiving emails that contain the virus. I'm running Exchange Server 5.5 with Outlook or Outlook Express.

9 replies

by shanghai sam

As you know, Symantec has released a free removal tool, available from http://securityresponse.symantec.com/avcenter/venc/data/w32.klez.h@mm.html (remove any space from this URL).

That the emails are still appearing probably means that somebody somewhere is still sending them. If your Exchange Server is connected to the Internet, the messages are likely coming from outside your organization. Norton AntiVirus Enterprise Edition, among other products, could intercept these at the server.
Although Klez disguises the origin of messages by changing the "From:" line of messages, it does not change the "Return Path:" line, so the source of infected messages can usually be found by examining the full header of the message (View, Options, Internet Headers, per Microsoft Knowledgebase Article ID Q189106).

When you determine who the infected mail is really from, you can refer them to the Symantec site so that they can download and run the removal tool, like you did.

If any of your LAN workstations are getting re-infected and sending rather than just receiving Klez messages, you can determine the source the same way, and assume that the infection engine attacked and disabled Norton Anti-Virus protection on that workstation.If that's the case, re-run the Klez removal tool, then uninstall, re-install and update Norton Anti-Virus on that workstation, or all workstations.

by sapinto

Though all the answers submitted really helped, I'll have to give the points to answer 1 because it helped me determine who was sending the virus and I was as such able to remove the offending machine. However, I also needed to use a tool called killklez which wasn't on the symantec website, which physically removed the virus hiding on the machine. The symantec tool simply deletes infected files and repairs registry items but doesn't remove the actual virus, and that's why it kept re-appearing.

by slyde phaeder

As a related note, for others reading this thread, sometimes Klez will remove or rename the Netbrext.dll file from the Norton Anti-Virus program directory. As a quick fix, try finding the file on another workstation and copying it to the same location on the workstation that can't start NAV, then see if you can open Norton Antivirus and run LiveUpdate.

If not, you will need to uninstall Norton Antivirus and LiveUpdate using Add/Remove Programs from the Control Panel, run the RNAV utility, and then re-install Norton Antivirus. Instructions and download for RNAV.exe are at http://service1.symantec.com/SUPPORT/nav.nsf/docid/2001092114452606 (remove the space, if it appears in this URL).

I do not think it is necessary to proceed past the section of these instructions that begin "To remove the registry entries for the virus definitions:", if NAV is to be re-installed.

One step not on this page that I recommend before a re-install is to search the C drive for files named "Settings.LiveUpdate", then delete all files found by this search.

Note that you can update your virus definitions on many versions of NAV by downloading and running the Intelligent Updater, without subscribing to the Update Service. The Intelligent Updater, if LiveUpdate fails, is downloadable from http://securityresponse.symantec.com/avcenter/download.html (remove the space, if any, from this URL)

Sometimes Live Update fails after re-install. The procedures for fixing this can get complicated, but Symantec instruction are good. You can start troubleshooting any Symantec consumer product via the following URL:

http://www.symantec.com/techsupp/consumer.html

by cmptrwzrd

Symantec tool is difficult for most users to implement properly. http://www.pandasecurity.com offers a Free Virus Removal tool called PQremove. Removes most viruses released in the past year, is simple to download and runs from the desktop. Very powerful little tool and small enough to email. Recipient just needs to copy to their desktop and doubleclick. Very user friendly and completely removes Klez as well as other viruses (Nimda, Love you etc..)

This discussion is closed to new replies.