VIRUS ALERT! W32.Klez

I have recently recieved some pretty strange emails, and had my preview pane in Outlook Express on. I recieved an email and new it was a virus by the title of the Email. By then it was too late, i had already opened it via my preview pane.

So ignored it for awhile hoping i was wrong, but found i wasnt just 5 minutes ago. I recieved an email, from myself with a weird subject. I knew i didnt send the email.

The virus i obtained was the W32.Klez virus. Here is what it does:

1. Payload: This worm infects executables by creating a hidden copy of the original host file and then overwriting the original file with itself. The hidden copy is encrypted, but contains no viral data. The name of the hidden file is the same as the original file, but with a random extension.

2. Large scale e-mailing: This worm searches the Windows address book, the ICQ database, and local files for email addresses. The worm sends an email message to these addresses with itself as an attachment.

3. Releases confidential info: Worm randomly chooses a file from the machine to send along with the worm to recipients. So files with the extensions: ".mp8" or ".txt" or ".htm" or ".html" or ".wab" or ".asp" or ".doc" or ".rtf" or ".xls" or ".jpg" or ".cpp" or ".pas" or ".mpg" or ".mpeg" or ".bak" or ".mp3" or ".pdf" would be attached to e-mail messages along with the viral attachment.

I would suggest everyone here go to this URL and read it thoroughly whether you think you have it or not:

http://securityresponse.symantec.com/avcenter/venc/data/w32.klez.removal.tool.html

YOU DONT NEED NORTON TO RUN THE TOOL!!!!

Download the FIX and reboot to safe mode the execute the fix while in safe mode. It will scan if your not in safe mode, but will not find anything, you must be in safe mode.

Run the tool while in safe mode, it will scan your harddrive for the virus and remove it. I would assume you have it already, and it would be safer for you all to do this on your computers, as i do not want this virus again.

Another suggestion for all you Outlook Express users. Turn off your preview pane in Outlook Express. Do this by going into OE and clicking on View then Layout. At the bottom you will see preview pane, make sure its unchecked. Whenever you get a strange attachment with an email, delete it without hesitation. if it was important they will resend it.

Hope you dont have it, i know i dont anymore, the tool found it, eliminated it and everything is working fine.
------------------------------------

"My Schwartz is bigger then yours!"

The clan of the future
United Gamers Coalition
[UGC]Lonestar

Jeez, you TWL guys are funny. I went ahead and used HTML in my post above to get it easy to read, and then i check your forum codes for the heck of it. You know what i find?

BB Codes! ARG!

After all that bracket, slash bracket, bold this underline that etc.... i find there is an easier way now!



Well good job on that anyways.
------------------------------------

"My Schwartz is bigger then yours!"

The clan of the future
United Gamers Coalition
[UGC]Lonestar

isn't it wierd to reply to yourself?




"From this day to the ending of the World,
... we in it shall be remembered
... we band of brothers."

LOL

Maybe im going Schitzo
------------------------------------

"My Schwartz is bigger then yours!"

The clan of the future
United Gamers Coalition
[UGC]Lonestar

I work at a computer store. This virus is devastating to computers! If left untreated there are certain variants that trash your hard drive's information, I suggest you all buy a copy of Nortons Anti-Virus 2002 unless you want big trouble. We do about 20 Klez repairs a week now in our service center of 4 people, Roughly 10 of these need to be formatted right then, and usually about 5 come back at a later date complaning about exe's not running. This virus can replicate in a number of ways, LAN, Email(uses its own program, so dont think you're fine if you dont have MS Mail Prog.).

Thanks for the info guys.

Just for clarity on the Klez virus. Klez works by sendig itself from the OUtlook or Outlook express address book/contacts list. What is does is random select a name from the address book as the sender then emails everyone in said persons address book. As a result the virus scanners and users who may later become infected beleive the the sender shown is in fact the actual sender. NOw, at this point in the ball game anyone who gets infected should take a look at themselves and decide if they should really be operating a computer . Get AV, I mean you really can't connect to the net safely without this minimal sort of protection. KLEZ, as with most mass mailing viruses now contain their own SMTP engine. As a result you probably won't even know you are sending anything. I would also recommend that anyone running win2k or any version of XP enable the tray icon that shows network activity. This is actually quite usefull because you can in fact see if you machine is sending or recieivng data. This is in itself might tell you if you are infected or being back doored.

For gods sake shut off the preview pane. In my office environment this is disabled on all of my users machines. I always disable it on any machine I build as well. If you want to see a preview then use the "Messages with autopreview" option. This will show you the first 3 lines of any message you receive. Since its reading text you will typically be fine. I can honestly say that no user that I have on my network has been infected with this virus because our AV updates twice daily and because I have made it a point to teach the users to be suspicous of any email that looks odd. Including stuff from people they know. Its all about common sense.

Well im not selling my computer for a mistake on my part.

You live, you learn.
------------------------------------

"My Schwartz is bigger then yours!"

The clan of the future
United Gamers Coalition
[UGC]Lonestar

Theres a real simple solution to this virus guys..STOP USING OUTLOOK EXPRESS...almost all viruses target this email program due to the fact its tied in wit the programing itself...Now im not sayin i know everything there is to know bout computers or anything but i do KNOW that this program is sent to only outlook express..I have a few choice friends who make viruses and antiviruses for a comp company..There job is to figure out how to make then and what to do to stop from getting them..And they both said that OUTLOOK EXPRESS is the simplest email program to send the virus to..And the other nasty part of the virus is that it sends the virus to all the email adresses you hve savved in your email address book..So be sure to warn friends about it...Thats why i use hotmail and not Express, since hotmail always runs an anti-virus program at there base of operations which means i dont have to worry bout that stupid shit..Ive been using hotmail for 5yrs and never got a virus yet and there been some doosies out there..So if you choose to keep using Outlook Express make sure to spend the bucks and keep your anti virus nice and up to date or your pretty screwed..




"AKA...TF_Gr|fTeR, SOF2"

LS, where you actually infected or did it just seem like you where. Most people don't have it, they just think they do because of the way the messages are sent out. I personally use Outlook 2002. Most executables won't run because of the security that has been added to the version. It actually annoys me. My AV traps most things and the rest I log to common sense prevention.

And LS, the people I refer to when talking about selling their machiens are the ones that get infected, have AV installed, then get infected repeatedly. AT some point they just need to pull their heads out of their asses.

Well funny thing is no virus was detected, but 17 files were infected.

All EXE files within my WIndows Folder, and some game EXE's including SOF and MOHAA.

What did i do about it? First ran the Klez fix tool. Then DL'ed Norton Antivirus 2002 try before you buy version.

Quarantined all my files infected.

Backed up every important file i had to a small 266mhz 4gb computer then reformatted.

Im just finishing up my format reinstall cycle now. No viruses detected or files infected.

I may not have been infected with the virus, but the infected files were all EXE's and when run they multiplied into something else. I looked at my HD yesterday night and noticed 1GB missing, and found about 30 new EXE's in my programs folder.

I had it with the whole deal, and instead of fixing everything I formatted everything.

Im going on to the second computer in the house and doing the same, my GF's mom opened a file and it was infected and she infected herself.

Right about now im sick of DOS, WIN98 and anything virus related.
------------------------------------

"My Schwartz is bigger then yours!"

The clan of the future
United Gamers Coalition
[UGC]Lonestar

Good chance that that is how you got it IF you are networked.

Well we are networked, but file sharing is off. Although we share the same HUB and Cable Modem we dont share files.

Until i wanted to reformat that is. Maybe there is a chance i got it that way but i doubt it. Im pretty sure i got an email, and my preview pane opened it. preview pane is off now and always will be and im looking to use a different email client. Possibly Outlook rather then Outlook Express. We'll see anyways.

As of right now, since my last post im right back to where i was minus the virus and useless files i had before. Ive been meaning to reformat for a long time, and i guess this virus, if i had it, gave me a good reason to do so. My computer feels faster and lighter for some reason, yet i have the same crap installed. Go figure.
------------------------------------

"My Schwartz is bigger then yours!"

The clan of the future
United Gamers Coalition
[UGC]Lonestar

hmm I may have it or I may not, Nav2002 detected it and quarentined 25 files, all exe of course, DLed and ran the tool and it found no viruses. friggin now what?

Make sure you run the tool in Safe Mode. Otherwise it wont work properly.

When i ran the tool it removed files but i was still infected, i ended up reformatting to get rid of it.
------------------------------------

"My Schwartz is bigger then yours!"

The clan of the future
United Gamers Coalition
[UGC]Lonestar

I actually lucked out. The other day I just installed NAV2002 on my machine and a couple days later, I recieved a strange email. Luckily, 2002 incorporates email scanning, so before I even thought about looking at the messages, it told me this email had the W32 Klez virus. I lucked out

yeah watch those strange emails with attachments, usually nothing in the body but by the time you see the body is empty its too late. I nailed mine down by installing nav2002 in safe mode, wouldnt install any other way. Quarentined the infected files, deleted them and reinstalled the programs after I ran the fix and deleted a couple more. Dont be stupit like me and not use AV. Heh I been on the net gaming and DL'ing for about 7 yrs with no AV...it'll get ya and AV is cheep.