Software

Ask something
Discussion Locked

Klez Virus?

0 helpful
3 replies

by ehoffman

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

I am flummoxed. A few people say their norton pops a klez quarantine when getting mail from me (just twice), and I have scoured my box...ran command line scan, the online version from symantec, did a hard target search of the right registry keys and files in the hard drive. Nothing! Ran the removal tool even. Nothing! Any ideas?

Is there some other way this thing could be hiding, or do I go on the assumption both these clients aren't so bright and it was another email that popped up thenotice, and they just thought it was me because I was in their inbox?

3 replies

by dklippert

Look at this from Norton:

http://tinyurl.com/7au

"This worm often uses a technique known as "spoofing." When it performs its email routine. it can use a randomly chosen address that it finds on an infected computer as the "From:" address, numerous cases have been reported in which users of uninfected computers received complaints that they sent an infected message to someone else.

For example, Linda Anderson is using a computer that is infected with W32.Klez.H@mm. Linda is not using a antivirus program or does not have current virus definitions. When W32.Klez.H@mm performs its emailing routine, it finds the email address of Harold Logan. It inserts Harold's email address into the "From:" portion of an infected message that it thensends to Janet Bishop. Janet then contacts Harold and complains that he sent her an infected message, but when Harold scans his computer, Norton AntiVirus does not find anything--as would be expected--because his computer is not infected.

If you are using a current version of Norton AntiVirus and have the most recent virus definitions, and a full system scan with Norton AntiVirus set to scan all files does not find anything, you can be confident that your computer is not infected with this worm."

This discussion is closed to new replies.