Printable View
Please help my network has been infected the the WORM_KLEZ.H worm and is kicking the **** out of my network i can not wipe the computers because their is to much to be lost by doing that has anybody come accross this virus and get give me some valid ways of geting rid of it.
Please Help Me!!!
The Klez.h virus only came about in April already it has overtaken SirCam as the most virulent worm ever, thanks to a clever mechanism designed to spread confusion
Lookie Here
The Klez.h virus only came about in April already it has overtaken SirCam as the most virulent worm ever, thanks to a clever mechanism designed to spread confusion
Lookie Here
Why don't people just update their anti-viruses? It only takes a few secs of time or maybe a few minutes depending if you are using a modem or not. Personally i know people who have gotten literally 21 klez viruses in one day but not one of them actually infected his network because he updated his anti-virus!!! a hint a sarcasm/mockery? yup. hmmm notice how it just doesn't seem to help? yeah but it was fun.
Why don't people just update their anti-viruses? It only takes a few secs of time or maybe a few minutes depending if you are using a modem or not. Personally i know people who have gotten literally 21 klez viruses in one day but not one of them actually infected his network because he updated his anti-virus!!! a hint a sarcasm/mockery? yup. hmmm notice how it just doesn't seem to help? yeah but it was fun.
well i got like 20 emails of it and i opened one of them but i have noticd nothing new or any laggin i got it removed hotmail does it :)...it has that norton thing that automtically deletes it i got an email fomr norton saying they removed it :)
well i got like 20 emails of it and i opened one of them but i have noticd nothing new or any laggin i got it removed hotmail does it :)...it has that norton thing that automtically deletes it i got an email fomr norton saying they removed it :)
Last thing I knew, Hotmail used Mcafee, not Norton... Has something changed? (Feel free to set me straight, I am just curious.) :)
- ura
Last thing I knew, Hotmail used Mcafee, not Norton... Has something changed? (Feel free to set me straight, I am just curious.) :)
- ura
That's what I was thinking too.Quote:
Originally posted here by uraloony
Last thing I knew, Hotmail used Mcafee, not Norton... Has something changed? (Feel free to set me straight, I am just curious.) :)
- ura
That's what I was thinking too.Quote:
Originally posted here by uraloony
Last thing I knew, Hotmail used Mcafee, not Norton... Has something changed? (Feel free to set me straight, I am just curious.) :)
- ura
I had the klez worm on my box a week and a half ago. It disabled my modem so I couldn't get online, it corrupted Norton Anti-Virus, which detected it but wouldn't fix it or delete it. I ended up downloading the removal tool from a friends house and putting it on disk. I'm so glad I got things to work again. I ended up having to reconfigure my modem. Very un-shibby.
I had the klez worm on my box a week and a half ago. It disabled my modem so I couldn't get online, it corrupted Norton Anti-Virus, which detected it but wouldn't fix it or delete it. I ended up downloading the removal tool from a friends house and putting it on disk. I'm so glad I got things to work again. I ended up having to reconfigure my modem. Very un-shibby.
I got a record 21 out of 32 emails infected with the klez at work a couple weeks ago. I get at least one every day.
I can't imagine how anyone could go without A/V and firewall protection today.
My nephews puter got klez'd and I ended up taking the easy way out....Format c:/s
I got a record 21 out of 32 emails infected with the klez at work a couple weeks ago. I get at least one every day.
I can't imagine how anyone could go without A/V and firewall protection today.
My nephews puter got klez'd and I ended up taking the easy way out....Format c:/s
my Norton's flags them and quarantine's the emails. It got onto my brother in law's machine before he update norton and disabled it as well. I agree updated protection is the only way to go.
my Norton's flags them and quarantine's the emails. It got onto my brother in law's machine before he update norton and disabled it as well. I agree updated protection is the only way to go.
HeyRdobson:
Here is a write-up on Klez.H :
All about Klez
This will instruct you what to do if the removal tool fails.
Good luck.
;)
HeyRdobson:
Here is a write-up on Klez.H :
All about Klez
This will instruct you what to do if the removal tool fails.
Good luck.
;)
AutoUpdates come in handy in this world of evolving viruses...
And what about heuristic scanning? Wouldn't it discover a mere variant of a known virus or is it only a gimmick?
AutoUpdates come in handy in this world of evolving viruses...
And what about heuristic scanning? Wouldn't it discover a mere variant of a known virus or is it only a gimmick?
My Personal mail is averaging just over 2 per day over the past 2 weeks.
not sure what was said here.. (trying not to ridicule the writer)..Quote:
well i got like 20 emails of it and i opened one of them but i have noticd nothing new or any laggin i got it removed hotmail does it ...it has that norton thing that automtically deletes it i got an email fomr norton saying they removed it
Though I heard some Semi wise words regarding e-Mail viruses - and that is let MSN or Yahoo worry about the Virus scann.. only prob is I thought they only scanned the attachments.. Have they taken to checking for Mal-Scripts in the html of the messages themselves now?
Oh and Scorp.. Heuristics seem to work on some varients.. but not a 100%.. But then what in this world is 100%..
Cheers Glenn
Maybe I am wrong, but I always thought even though your virus definitions may be updated to the second. If the virus hadnt been reported and looked at by Mcaffe/Norton, then it would pass the virus right through. Or can it identified because it has varient 'cousins'? Lemme know, I am confused.
BTW DONT USE OUTLOOK/OUTLOOK EXPRESS!
uralooney and preach no i thought so too but i am pretty sure my email was from norton and i sure as hell dont have it installed on my home pc :( ...i ran the removal tool and it didnt find it so it really did get rid of it :)...nortons arms stretch among the wide cyberspace :)
fwiw...i wouldn't trust any email that says it was scanned by anything other than my own scanner...i'm too lazy to look right now...but it wouldn't surprise me if klez has as part of its social engineering a "scanned by norton" line ...whoever coded this thing gave it a large number of tools to make you think its ok like:
returned mail sent by you
klez removal tool
faked from addresses
and a bunch more...go read up on it....it's some interesting stuff...
You'd be amazed at how many people don't realize the have to UPDATE their def files. Most people think once they install an anti-virus software, all they have to do is run a scan on their system now and then. :) It cracks me up because it is like buying a car and never expecting to have to put gas in it or change the oil...lol.Quote:
Originally posted here by rasem
Why don't people just update their anti-viruses? It only takes a few secs of time or maybe a few minutes depending if you are using a modem or not.
I deserved it, honestly. I disabled Norton so I could play with Netbus and mess with an IRL guy who keeps toying with me (long story no one needs to hear) *LOL*.....He kept freaking out over the keys getting locked up and the cd tray going schitzo on him.....HAHAHAHA God, being a scriptkiddie is sometimes worth it. Flame me if you want....I got mine though. Ack.
Hmmmm.....I wonder if he's ever seen Fatal Attraction..... *twitches and laughs*
MUAHAHAHAHA
Speaking of Klez.H, I received a record of 17 Klez-infected emails yesterday.
:fpissed:
Toker, Scorp666
Dont know about Norton (wont allow all that hidden registry shenanigens near my system) but mcAffee will pick it up with the updates from february, provided you have the SCAN ALL switch AND Heuristics (All) AND Unknown virus scanning running.
picks it up no probs.
and if we are playing with stats.....
main delivery: 15 a minute at max period (23-28 april)
Secondary: a meager 12 an hour.
:p
hardest part is the morphing From line.....Ive grown tired of explaining to users whats going on......
:rolleyes:
I get this worm at least 50x a day. I have an up-to-date virus scanner. The problem I have noticed is that other people with the virus have spoofed my email address on it. The reply to address it puts in is my address. I do not have the worm, I get a ton of undeliverable mail messages coming back to me. I check the source of the message and my address is in the reply to field. My address is on a website with a lot of traffic. I assume the worm goes through a users temporary internet files and finds address' there. It is a big pain in the a$$. Is there any way I can prevent this? Any advice would be appreciated.
apprentice - Since the Klez infected messages typically use another address they find on an infected computer as the "from" on the infected messages they send out, it is pretty hard to avoid if your email is likely to be on many computers due to your website. However, you might try checking the return-path address on infected messages you receive. This might lead you to finding one or more of the infected computers. But should you contact them, they would still have to open and read your email and do something about it before it would help you.
More information on the return-path discussion is found in this thread.
emrys - I agree wholeheartedly with zigar on this one. It seems I read somewhere also that such emails claiming to come from Norton or McAfee were used by Klez and actually contained the Klez worm. (I don't have time now to look for it.) But I definitely would not trust anything coming in an email. Make sure you have an antivirus with updated virus definitions on your computer, have it set to scan all files, preferably with heuristics scanning, as well. However, not every email which is "supposed" to contain the worm actually does. I know, I got one which was an exact example of an infected message as shown on the Symantec website, but the message I received was not infected. Others, however, were, and Norton quarantined them.
Airhead saith:
"I read somewhere also that such emails claiming to come from Norton or McAfee were used by Klez and actually contained the Klez worm. (I don't have time now to look for it.)"
Trend Micro calls this Klez.g. Norton seens to call this Klez.H
What ever you call it, it is a very powful tool. <lame anti-virius humor>
i have not had an email with the klez.h worm yet yippee ive got the removal tool just incase :)
Is the tide turning.. or is it just a laps in the flow.. 3 days with out a Klez mail here or at work..
cheers
bah stupid me i think i got infected again...so of i go to start up in safe mode once again to remove this damn worm...bah
HeyEmrys:
Stop.
Think.
Exactly what did you do that could have infected your computer with the Klez virus ?
::coffee::