Remember the Klez!!!

[bdhoff]

I don't know about any of you, but I remember how tough it was to get Klez out of my network.

Read this article:

Klez set to return (http://msn.com.com/2116-1105-956740.html?type=pt)

A minor variant of the Klez virus is set to go into action Friday, erasing a host of files on infected hard drives. But the attack may also wipe out the attacker.

[bArGuS_4_$]

Klez.E and any other worm is always very difficult to remove from a network environment. Your IRT (Incident Response Team) needs to react fast and decisive to eliminate the threat. If only one node in your network is infected it can allow a Worm to propagate on even protected machines using the infector's resources never making a function call to the protected machine.

Best bet...If your scared...and you should be....set-up a Honey Pot and look for machines that match the profile and take them out of action.

Provides some useful information on Klez.E

http://securityresponse.symantec.com/avcenter/venc/data/w32.klez.e@mm.html

[bighabu]

We got rid of it on our network but peoples home PCs keep trying to spread it agin. Thank goodness Norton anti-virus stops it in its tracks evertime. No matter how much you tell users not to open certain attachments they do it anyway.

[bArGuS_4_$]

You may want to look into another Mailer AV program as well. If you are an ISP that is using something similiar to MSE 5.5 or 2k or something along that lines, you should be able to find an AV that will scan your information store or your mailboxes and eliminate those viruses before the user can get them.

If your talking about Yahoo or Hotmail, you may want to look into a proxy or perimeter AV product. Something like Symantec Web Security will scan http and ftp connections for viruses and that may be the best bet to cover those areas.

Let me know...How it goes