Klez.H

**Zerotech** · April 30th, 2002, 08:07 PM

I just got that one myself. Thank God the Norton AV was just updated, it intercepted this one and the two that came before it. I've only had it come to my home system, not at work.

**Deity** · May 1st, 2002, 08:22 AM

It's funny, but I had the email show up at my office without the attachment.

**Stalemate** · May 6th, 2002, 10:52 AM

<blockquote>quote:<hr />Originally posted by Deity:
It's funny, but I had the email show up at my office without the attachment.

<hr /></blockquote>Your e-mail server (or it's anti-virus/firewall system) may prevent specific files or file extensions from reaching your desk.

I've just met my first instance of Klez on a client machine, and I'm impressed at the amount of damage it's done.

I'm starting to wonder if formatting/re-installing might not be the safest/fastest thing to do for this poor guy. <img border="0" title="" alt="[Frown]" src="frown.gif" />

**Deity** · May 6th, 2002, 11:07 AM

<blockquote>quote:<hr />Originally posted by a d e p t:
Your e-mail server (or it's anti-virus/firewall system) may prevent specific files or file extensions from reaching your desk.
<hr /></blockquote>To my knowledge we didn't have any type of filtering or AV running on the email server. Which was why I posted the thread about different AV solutions. The sad part is that the IT staff here is composed of me, myself and I. Even taking this into account, the CEO won't give me admin access to the email server. He insists that the information is too sensitive and he wants to retain a higher level of control over it. Meanwhile he just took off for a week for some type of conference, so if anything goes wrong with the email, we are screwed.

I can only hope that our email server rns smooth for the next week.

**Stalemate** · May 6th, 2002, 11:33 AM

Another possible explanation may be that the outgoing server (from which the infected e-mail was originally sent) may have some type of verification for outgoing messages going through it.

As for the e-mail server problem, there *are* ways to work around it, if you really need to <img border="0" title="" alt="[Wink]" src="wink.gif" />

But do try once again to get admin rights to it. You could even try to downgrade your superior's rights by justifying it with a "it will keep you from being sued if an employee claims a breach of personal privacy".

Good luck with that!

**Deity** · May 6th, 2002, 12:23 PM

Thanks. I think I'll be able to convince him in time. Hopefully. <img border="0" title="" alt="[Wink]" src="wink.gif" />

**Todo** · May 7th, 2002, 07:31 PM

Well today I was working on my bosses wifes machine. She suspected a virus. They had NAV 2001 installed,but I couldn't get it to work. I went through the uninstall, then reinstalled it,but it still didn't work. So finally, I downloaded AVG and it found the Klez.E and Only_Game virus. Some of the infected files were NAV. So, it cleaned up the sytem,but affected ALL the JPG files. I couldn't open a single one. They opened up an email about 2 weeks ago which they believe spread the virus. I'm just glad I didn't have to reformat and reinstall her machine.

**Renée** · May 8th, 2002, 01:15 AM

<blockquote>quote:<hr />Originally posted by Deity:
 ...Even taking this into account, the CEO won't give me admin access to the email server. He insists that the information is too sensitive and he wants to retain a higher level of control over it. Meanwhile he just took off for a week for some type of conference, so if anything goes wrong with the email, we are screwed.

I can only hope that our email server rns smooth for the next week.<hr /></blockquote>

Boy, does that smell familiar. Sounds like my last job. Makes you want to ask why they hired you in the first place, doesn't it? That's okay. If they don't listen to you, they will end up learning the hard way. But if you're in the same position I was in, when they learn the hard way, you'll be the one cleaning up the mess.

**Deity** · May 8th, 2002, 08:20 AM

<blockquote>quote:<hr />Originally posted by Renée:

Boy, does that smell familiar. Sounds like my last job. Makes you want to ask why they hired you in the first place, doesn't it? That's okay. If they don't listen to you, they will end up learning the hard way. But if you're in the same position I was in, when they learn the hard way, you'll be the one cleaning up the mess.

<hr /></blockquote>The really stupid thing is that I already have root access to all the servers! I have the highest level of authority to all the systems! He just won't give me a password to access the email configuration.

What he doesn't realise is that the emails are stored in plaintext in simple folders corresponding to the usernames. I can open those and read any mail I want. The exact stuff he wants to protect is the least protected!

**Commander Klarg** · May 8th, 2002, 09:04 AM

<blockquote>quote:<hr />Originally posted by Deity:
 <blockquote>quote:<hr />Originally posted by Renée:

Boy, does that smell familiar. Sounds like my last job. Makes you want to ask why they hired you in the first place, doesn't it? That's okay. If they don't listen to you, they will end up learning the hard way. But if you're in the same position I was in, when they learn the hard way, you'll be the one cleaning up the mess.

<hr /></blockquote>The really stupid thing is that I already have root access to all the servers! I have the highest level of authority to all the systems! He just won't give me a password to access the email configuration.

What he doesn't realise is that the emails are stored in plaintext in simple folders corresponding to the usernames. I can open those and read any mail I want. The exact stuff he wants to protect is the least protected!

<hr /></blockquote>Silly, aren't they? Be careful; he might get the idea to try and take your root access away.

**Imagenatas** · May 9th, 2002, 12:31 PM

My company just got hit with this over the last 2 days. Thanks goodness we've updated in time. This virus is pretty horrndous because it seems like it's ubiquitous. It's popping up every 30 minutes or so with the name of people whom used to work at this company.

**Renée** · May 10th, 2002, 09:07 AM

<blockquote>quote:<hr />Originally posted by Deity:
 The really stupid thing is that I already have root access to all the servers! I have the highest level of authority to all the systems! He just won't give me a password to access the email configuration.

What he doesn't realise is that the emails are stored in plaintext in simple folders corresponding to the usernames. I can open those and read any mail I want. The exact stuff he wants to protect is the least protected!

<hr /></blockquote>Ugh. This is giving me flashbacks.

I had about 55 users on a Novell network with one measly file/print server when I was at the job I was talking about. I was the one and only MIS person they had on site. But...the CEO wanted the server itself to be located in my supervisor's office, to which, of course, I didn't have a key. DUH. I, like you, had access to every file on there. I never did figure out why he thought the server shouldn't be in my office, but I sure got a lot of pleasure when the thing crashed and neither my supervisor nor the CEO were around so that I could get in and reboot the thing. (I was always around.) All 55 users pleading for the server, and not a blessed thing I could do. I felt sorry for the users, but I loved telling them why I couldn't fix it. Our CEO was trying to make tech decisions and he needed his hand held just to log onto AOL (which, of course, he refused to replace with another internet service).

Arrrgh!! I really feel your pain, Deity. If you ever feel like crying and moaning, come see me...

BTW, the company I'm talking about is the same one that started this thread...the one I got 200+ copies of Klez from.

**edball** · May 17th, 2002, 01:46 PM

I just have to keep explaining to my users that "No, you don't really have a virus", when they get sent back an e-mail from someone's AV program because there e-mail address happened to reside somewhere on the infected pc.

**randy** · May 17th, 2002, 06:30 PM

Hey I also was working on a pc at work and found the worm_klez.h which was randomly writing itself to files with wink in it and placing itself in the startup group (msconfig) and/or in the register in run or runonce. I found the fix at trendmicro's website <a href="http://www.antivirus.com." target="_blank">www.antivirus.com.</a>
Hope you all have a good weekend I have to work all of it !!

Thread: Klez.H

Thread Tools

Display

Bookmarks

Bookmarks

Posting Permissions