early_s_man -- a special good tool

[island911]

That was the email header sent to me.
It contained the klez virus.

Clearly someone has targeted Pelicanites. I just wanted to say thanks to who-ever is doing this. . . thanks for changing the "from name" and title. I was getting really tired of seeing "From:Wayne at Pelican Parts".

If anyone else got this, or similar email (and didn't have protection) you've got klez.

Funny, it use to be hicks would drive around, late at night, hitting mailboxes to fill their pathetic existance.
How's it go; the more it changes, the more it stays the same.

[Jim T]

Pardon my ignorance on this subject, but I thought to get a virus, you had to open an attachment - i.e. you can't get a virus by just opening an e-mail.

That's not true???

[Neilk]

Jim,

Apparently, if you have the preview pane option enabled in Outlook or Outlook Express, viruses can still work, especially if none of the recent Microsoft patches have been installed.

[island911]

Jim -- That's what I use to believe.
It depends on what version of Microsoft Backdoor . . .er . . Outlook you have.

[Jim T]

Thanks.
Yeah, that could make a virus pretty potent, if it can get in without the recipient having to open an attachment.

[autobonrun]

Originally posted by Neilk
Jim,

Apparently, if you have the preview pane option enabled in Outlook or Outlook Express, viruses can still work, especially if none of the recent Microsoft patches have been installed.

I understand this is a weak point in the Preview Option. I keep my preview option disabled at all times for this reason.

[Jim T]

Silly question, but how do you disable the preview option in outlook? I have virus protection, but I'd like to disable preview anyways - not useful to me and why take a chance. Thanks.

[Cornpanzer]

My understanding of that Klez virus is that it gets into your address book and other history and picks one name out to send an infected file to another name. So, If you get an infected file from Early-S-man for example, this doesnt neccesarily mean that he sent the email or that he is infected. There are several free anti-klez programs out there. I manage to get infected every month or so without opening any attatchments.....just have to keep up on it. I got my anti-klez program www.bitdefender.com and it works great.

[island911]

Yeah, Cornpantzer, I know what you're saying; but that's not what is going on. Someone is being quite selective; choosing well known pelican names. The random "pick and send" is not what is going on here.

[pwd72s]

Thanks for the heads up....Also thanks to Cindy for insisting we buy McAffee....

[emcon5]

Originally posted by Jim T
Silly question, but how do you disable the preview option in outlook? .

In Outlook 2000, you click on "View" and uncheck "Preview Pane"

For Outlook Express, you click on "View", then "layout" and uncheck the box next to "Show Preview Pane".

Or you use Mozilla

Tom

[cstreit]

I know I've been getting a boatload... But not from Pelican Members. Probably 3-4 per day.

[masraum]

The best klez removal tool ever!!! You'd think this thing was engineered by Porsche, very small, fast, efficient.

http://www.webattack.com/get/antiklez.shtml

I've had several people from my parents to users on the Rennlist use this with 100% success.

[masraum]

Another note. I use Outlook at home, have no virus protection, have 4 internet users on the family computer, have a DSL connection (the comp is on 24x7), and have yet to get a virus (at least not since '88). The secret to this in outlook is going into Tools | Options | Security, and then somewhere in that area (it's different for different versions) will be a setting to disable or quarantine potentially harmful attachments. I have that enabled, I have the preview pane enabled, and I receive a fair amount of email, and that one setting has blocked all of the viruses that I have received.

[john70t]

Heres some more stuff:

www.zonealarm.com good personal firewall in and out
http://www.lavasoftusa.com spyware checker
www.symantec.com some Klez fixes

[Wayne 962]

As I told Island911, these emails are coming from people who have infected computers, who are 'subscribed' to this forum, or receive email from people through the forum. There is no concerted effort to attack Pelicanites, and there is no way to get the email addresses out of the BBS, short of hacking into the server.

This is standard virus email that is being sent from people who have received email from you before. It has nothing to do with the BBS...

-Wayne

[jrdavid68]

Klez is pretty sneaky. Those of us that have been supporting end-users for awhile (who remembers Lunch.b and NPAD?) - it sure can be entertaining to watch some of this. It can also be a royal pain in the a$$ to always have to try to explain how they work - like in the above posts - and, very hard not to say "I TOLD YOU SO" when the users are not proactive in updating their virus software ("Oh, it won't happen to me, I am very careful" - Yeah - whatever).

I don't see in the above notes about Klez that it also scours your hard drive for html files, Word docs, Excel files and many other types of files in order to glean e-mail addresses to target.

So, if a user frequents this board, that user will have a bunch of cached information from the Pelican web site, e-mail addresses of other Pelicanites etc. on their hard drive in various files and formats. Klez can find that information and use the e-mail addresses and info that it finds to send itself out - pretty cool, huh?

So, seeing the subject line that Island911 provided doesn't surprise me in the least - certainly there isn't anyone out there targeting our friends on this board - in fact, the problem lies right within our member base for not keeping their virus protection software up to date! This should be a weekly event for everyone!

If you would like to see some more information on Klez, go here:

KLEZ

Enjoy,
JrDavid68

[island911]

Alright then, if these emails are coming from people who have infected computers, who out there has on their computer:
1) Warrens email address
2) Waynes email address
3) my (island911) email address
AND
4) no virus protection.
5) no one else in their address book

?

also, I dont believe there is a "concerted effort to attack" . .. just one is my bet.

[Jack Olsen]

As I understand it, Klez can't infect a Mac. Is this like thinking you can't get pregnant in a hot tub?

[island911]

That's what they want you to think!