Worm using own SMTP engine

This question is also about W32.Klez. When my friend, whose computer was infected with this worm, called her ISP, she was told by the technician that she could go on the Internet to get the removal tool and instructions, but she should not open her Outlook Express, as that would send out more infected messages. Is that accurate?

Since Klez uses its own SMTP engine, does Outlook Express have anything to do with it once the computer is already infected? Or would just turning on her computer and making the dial up connection send off the next round of infected messages which is in the code?

Sorry I just don't comprehend how such things work.

Go here and you will find almost everything about this virus.

good luck:)

Here ia another article on Klez.H:
http://www.antivirus.com/vinfo/virus...me=WORM_KLEZ.H

sun7dots - Thanks, but I've already been there, maybe a dozen times. And also to the other 13 sources I got when I did a search on the Symantec website for w32.Klez. And to the information at Panda Software, too.

No where did I find an answer to this specific question. The literature says that Klez uses its own SMTP engine, but I just don't understand the details of how that would work, nor the implications.

Now that a computer of the secretary of a large organization to which I belong has been infected, I expect I'll have to answer a lot more questions, since there are many members whom I suspect don't have antivirus programs to protect them.

Something's got to launch the code for it to start the SMTP engine, such as double-clicking the attachment; hence the advice not to start OE, since using the preview pane will cause the code to launch.

Use an updated antivirus and patch outlook and you won't have any problems anymore with klez

m4ilm4n - Is this true each time the worm is executed? I'm talking now about a computer on which it has already executed once.

Your question seem to be that once a computer is infected by Klez, can the worm/virus by itself utilize Outlook Express to send infected emails when the PC logs on to the internet?
If this is the question, I have never seen the answer.

bucket - Your last reply is exactly what I meant. Thanks for rephrasing that for me.

I forgot to explain that smtp thing
A virus with it's own smtp engine can send mail without using Outlook, Outlook Express, Netscape or any other mail program. It is a good way to avoid partially patched Mail clients.
A properly patched mail client will not allow executable attachments to start on reception hence stop the virus dead. Also some antivirus programs will monitor incoming mail for viruses. Another line of defense is a firewall that will block that smtp engine if other lines of defense were inadequate or disabled.

I hope this explains what you wanted to know.

Time to patch that comp dear!

concerning that question, yes the worm will send copies of itself whenever you log on the net.

Thanks, Scorp666, for providing that information. That's what I wanted to know.

Norton has caught the infected messages I have received every time. My computer is also patched, and I'm so paranoid that I have the Mail Safe in Zone Alarm enabled, too. But understanding how the worm really operates helps me give more accurate information to all these friends who are basically clueless when it comes to security. Can you believe - they have to come to a computer Airhead for help?

Outlook is only a mail client, the virus searches it's address book (and various other places) to find valid e-mail addresses (likely builds a sorta database of addresses). Once this is done, the virus will use its own SMTP engine to send outbound e-mail (Outlook does not need to be started). The virus will likely start-up every time the computer starts-up due to settings in the registry. In most cases the infected user will not even know anything is going on, it's all in the background. Does this clear it up a little for you?

Cheers :D

Thanks, DjM, that's how I thought it might work after reading that Klez had its own SMTP engine. But when that tech at the ISP told my friend not to open her Outlook Express after he/she knew the worm had already executed, I thought I might have been mistaken. You've given a clear explanation.

Thanks, Scorp666