w32/Klez.eml virus fwd rec'd from morrus

[grodog]

Morrus---

FYI, this evening, I rec'd an email from morrus@d20reviews.com entitled [Japanese girl VS playboy] infected with the W32/Klez.eml virus. My McAffee caught and killed it. I thought you might want to know, since it looks like you've got it.

For info on how to kill this virus, read McAffee's web site at http://vil.nai.com/vil/content/v_99237.htm.

FYI, I've also already reported this thread to the moderators, no need to do so already, in case the thought crossed your mind.

 

[Eternalknight]

Yep, I too got it. It uses random subject lines (mine was something to do with Macs). I have emailed Morrus with the details. For those less in the know, Morrus DID NOT send this out deliberatley. His system has been infected by someone else.

 

[Morrus]

Tell me about it...

I'm getting 10-20 of these every day from all sorts of people, all with the most bizarre subject lines. Running the tool to remove it comes up a blank.

If anyone gets an email from me which doesn't make sense or seems atypical of me - then in all probability I didn't send it.

DON'T open an email from me with a strange looking subject line, and certainly don't open an attachment from me unless it is something you're expecting.

Sorry for any confusion it might cause.

 

[turtle]

Welcome to the wild world of hacking BS!

When the "I love you" email virus went out I sent a bunch of emails to my friends which had "I love you" as the subject line as a joke. Of course, the only text was "boo"

 

[Eternalknight]

Morrus: Which removal tool did you use and what AntiVirus software do you have? I have been recieving many of these emails too, but it has been blocked by Norton each time. Another trick is if you have ICQ or AIM remove your email address from the details; most of the viruses seem to be coming from there. I did this and I haven't recieved it in the last 48 hours (I was getting just over 5 a day)

 

[Darkness]

FYI, I've also already reported this thread to the moderators, no need to do so already, in case the thought crossed your mind.

With the "report this post to a moderator" button? That thingie sends an e-mail to the moderators - from Morrus' account. Kinda ironic, neh?
(Strangely, I didn't get one this time, BTW.)

 

[JohnNephew]

Doesn't this virus spoof the From: field? I know it's made the rounds among some folks in the game industry (from discussion on an industry board). The impression I have is that the virus creates e-mails with "From:" fields containing addresses from your machine -- so some other infected person would be sending messages that appear to come from Morrus. As I understand it, this is one of the problems in tracking it down, because the person you think is infected (because the mail appears to come from them) actually is NOT, and the person who IS infected doesn't get told.

If I'm right about this, then anyone who has ever e-mailed Morrus might actually be the source of the problem. Bottom line, if you're a PC user (especially with a MSFT e-mail client; I think this is one of the ones that takes advantage of vulnerabilities in unpatched software, running in the preview pane), please check your machine for viruses. If nothing else, go to the free online checker at Symantec. And update your software with security patches (go to www.windowsupdate.com for a start). If you use Outlook Express, it's a good idea to turn off the message preview pane, too.

 

[LightPhoenix]

Doesn't this virus spoof the From: field?

Yes, it does. It's a relatively simple thing to do.

 

[Henry]

Interesting note: It does spoof the From: Field, but if you look at the message's message header, specifically the reply path, you can see whose account it REALLY comes from. Usually, you might get 20 e-mails a day, but chances are they're really all from the same computer.

This virus hit our workplace on the week of April 17th, and caused much confusion and fear, but very little actual damage. As I understand it correctly, the virus piggy-backed to the worm only wakes up on March 13th. and September 13th.

Huh.

It always makes you wonder - the guys who build these things are damned smart. Why waste that much talent on something like this, which doesn't pay a dime, and still live on someone's minimum wage offerings?

There are some people with some strange values out there.

 

[Eternalknight]

Doesn't this virus spoof the From: field?

Explains why I have been getting it from people I don't know