FYI!!! klez.e virus activates on the 6th

[jay015]

Here's some info I got from F-secure. Seems like a bad one!!!

This press release comes from F-Secure. For more
information on F-Secure's mailing list policy,
see end of message.


Klez.E worm activates destructively tomorrow

F-Secure is warning computer users that the Klez.E email worm will activate
destructively tomorrow, on 6th of month. Klez.E is among the ten most
common viruses wordwide.

Klez.E was originally found in January 2002. It has been getting steadily
more common over the last weeks and by now it has become one of the most
common viruses in USA, Europe and Asia.

Klez.E activates on every 6th of the month, but the activations in January
and February 2002 were causing relatively small damage. Situation is now
more serious.

Klez.E is a very complex virus. It sends itself via e-mail using a wide
variety of different messages, including messages which look like virus
warnings. Sometimes Klez fakes the e-mail sender, making it look like an
innocent bystander has been spreading the virus. Klez.E also fights against
various anti-virus products, trying to delete them.

In addition, the e-mail attachments sent by Klez can execute automatically
on some systems, causing infection by just reading or viewing an infected
e-mail message.

"Klez.E activation routine is destructive", comments Mikko Hypponen,
Manager of Anti-Virus Research at F-Secure. "It overwrites data files such
as Word DOC files, Excel XLS files, MP3 music files, website HTML contents
and ASCII text files. Even worse, it does this not only on the infected
machine but also in the local network. One infected PC with write access
can overwrite data companywide".

The Klez virus family is apparently written by a single virus writer
somewhere in Asia, as they contain texts such as "made in Asia", "Well paid
jobs are wanted", "I want a good job, I must support my parents", and "I
want a salary of $5500 a month".

F-Secure Anti-Virus detects the Klez viruses.

More information and screenshots are available at
<a href="http://www.F-Secure.com/v-descs/" target="_blank">http://www.F-Secure.com/v-descs/</a>

For more information, please contact:

Mikko Hypponen, Research Manager, Anti-Virus Research
F-Secure Corporation
Pl 24
FIN-00181 Helsinki
Tel +358 9 2520 5513
Fax +358 9 2520 5014
Mobile +358 400 648 180
Email: [email protected]


<a href="http://www.F-Secure.com" target="_blank">http://www.F-Secure.com</a>

[Wyckyd1]

Thanks for the Heads up. The subject lines that are randomly used are just too enticing for some people even though they know better so I will be mailing this alert out to some people.

[firemonkey]

Our mail server antivirus has stop 6 attachments with it. Watch out it is a mean bugger