Worm using own SMTP engine

[Scorp666]

concerning that question, yes the worm will send copies of itself whenever you log on the net.

[Airhead]

Thanks, Scorp666, for providing that information. That's what I wanted to know.

Norton has caught the infected messages I have received every time. My computer is also patched, and I'm so paranoid that I have the Mail Safe in Zone Alarm enabled, too. But understanding how the worm really operates helps me give more accurate information to all these friends who are basically clueless when it comes to security. Can you believe - they have to come to a computer Airhead for help?

[DjM]

Outlook is only a mail client, the virus searches it's address book (and various other places) to find valid e-mail addresses (likely builds a sorta database of addresses). Once this is done, the virus will use its own SMTP engine to send outbound e-mail (Outlook does not need to be started). The virus will likely start-up every time the computer starts-up due to settings in the registry. In most cases the infected user will not even know anything is going on, it's all in the background. Does this clear it up a little for you?

Cheers

[Airhead]

Thanks, DjM, that's how I thought it might work after reading that Klez had its own SMTP engine. But when that tech at the ISP told my friend not to open her Outlook Express after he/she knew the worm had already executed, I thought I might have been mistaken. You've given a clear explanation.

[bucket]

Thanks, Scorp666