VIRUS ALERT!! To All Board Users

nunn

Recently, I have gotten a bunch of those screwy emails with a short message trying to get me to open an attachment.

I won't open the attachment, because that is where the Klez virus is hiding.

All of the emails I have gotten recently are from members of this board.

Apparently, the Klez virus has invaded someone's address book, and is doing it's thing. I am clean here.

Here is a link to a FREE fix of the virus:

http://securityresponse.symantec.com/avcenter/venc/data/w32.klez.h@mm.html

Please download and run it according to the instructions, that is, in SAFE MODE. If the Klez virus is there, this program will eradicate it and tell you about it. If it is not there, it will tell you that too.

I had it a while back and got rid of it using this program.

Here is a link to a FREE anti-virus program that works really well.

http://www.grisoft.com/html/us_index.htm

SIG pistol armorer/FFL Dealer/Full time Peace Officer, Moderator of General Discussion Board on Gunbroker. Visit www.gunbroker.com, the best gun auction site on the Net! Email davidnunn@texoma.net

Bullzeye

Just so you know, the Klez virus (unlike the Sircom virus) gets both the From: field and the To: field from an infected address book.

This means, if Joe gets the Klez virus, and he's been in email contact with Fred and Bill, the virus could send an infected email TO Bill, that says its FROM Fred. Because both names are in the infected address book.

Another thing the virus likes to do: send fake "Email returned. Message Undeliverable" messages. When you send an email to an address that doesnt exist, you get a message back from your email provider (like postmaster@aol.com, or postmaster@earthlink.net) saying it could not be sent. This is called a "postmaster bounce".

Klez will send out fake postmaster bounces (with virus laced attachements) to try and trick you into opening the attachment out of sheer curiousity.

duckhunter

10-4 thanks,

I WOULD RATHER BE DUCK HUNTING.

Gordian Blade

When I first started getting Klez emails, I would respond to the person who appeared to have sent the email and suggest they check for Klez. Now I don't bother because they probably didn't send it.

One other thing about Klez -- I recently had to eradicate it from my wife's computer, and I found that the only reliable way to do it was to boot the computer into DOS from my Win98 backup floppy, not Windows, and run a DOS program I downloaded from the McAfee web site.

Judge Dread

MMMMmmmm! At least this is not "Amish" in origin.....

HEHEHE!

400 million cows can't be wrong ( EAT GRASS !!! )

concealedG36

For those of you (Nunn) who may have access or input as to messaging gateway software, I've found a nice product for Microsoft Exchange Server called Nemx http://www.nemx.com/index.asp . This product will scan incoming and outgoing mail at the gateway (mail server) effectively eliminating most infected attachments (including those infected with the W32.Klez.H@mm worm. The software can also be configured to filter unwanted file types such as those ending in .exe, .bat and .vbs and even reduce SPAM and other unwanted e-mail.

I do believe similar products are available for other messaging systems such as Groupwise for NetWare, etc.

I now receive about 98% less unwanted and potentially harmful e-mail than before I installed this product.

G36

Gun Control Disarms Victims, NOT Criminals

offeror

David --
I got the same series of e-mails a few weeks back. I recognized it as a virus attempt immediately because I knew that one of the e-mails would have the Subject Line "your password" in the bunch. I opened the "Properties" of one of the e-mails, where I was able to determine that your address was part of the source info. No problemo, I eradictated the virus.

But once infected, a computer with your address on it could try to send the virus back to you. So those infected by your computer, after you've cleaned house, could inadvertently be the source of an attempt to re-infect you.

One thing people can do to avoid re-infecting Nunn or other friends is to delete any unnecessary entries from your address books. These things love to spread by sending covert e-mails to everyone in your book.

I personally have increased my security settings, upgraded my Norton AV software settings, and added a good Firewall. This firewall, by the way, continues to warn me of attempts to access my computer from other computers, some of which are probably hackers and others of which are probably attempts to infect my computer through a "backdoor" virus.

I'll repeat what I said earlier. Now that a worm-type virus is known to exist around here, anyone on this board could have an infection and not be aware of it. Anyone who has been a member for more than a couple of weeks is at some level of risk. You need to update your virus software with the latest virus definitions list, and run it on your entire computer, excluding nothing. Make sure your Exclusions list is empty before you run the virus check. The virus check will take maybe 20 minutes. If it finds a virus or worm, let it attempt to repair and quarantine. If your "_RESTORE" directory is infected, you will not be able to repair or remove the virus from there directly. You will have to first eradicate the virus from all your active files.

After your computer is completely clean of viruses (keep running your virus checker until it gives a clean bill of health to everything but _RESTORE) then you can turn off the "Windows Restore" feature, reboot, and turn Windows Restore back on again. That should NOT be done until your computer is clean and stable. Turning off the Windows Restore feature temporarily will delete the infected _RESTORE archive folder (your backups) altogether. When you restart and turn the "Windows Restore" feature back on, it will begin making clean backups for future restores that are virus-free. Keep running the virus checker for a while at regular and frequent intervals to insure your eradication of the worm is complete.

If you don't have a good virus software and a firewall like ZoneAlarm or Norton Firewall, you are almost certainly doomed to infection once a board moderator with everyone's e-mail addresses in his book has had a virus. Nothing against Mr. Nunn, of course, but the facts are the facts. If you've ever e-mailed Nunn, your address is probably in his address book. Which means it is conceivable, even likely, a hostile program could have sent you a virus without his knowledge.

Of course, if you are using a peer2peer program like Kazaa without AV software and a Firewall, you are doomed to viral infection, sooner or later. Probably sooner.

- Life NRA Member
"If cowardly & dishonorable men shoot unarmed men with army guns, the evil must be prevented by the penitentiary...and not by general deprivation of constitutional privilege." - Arkansas Supreme Court, 1878

Edited by - offeror on 08/07/2002 00:09:32

Ms. Beast

I went and updated everything and did a check, we look to be all clean, hope to stay that way!!

Thanks for the heads-up on this thing!!