View Single Post
  #7 (permalink)  
Old Sun May 05, 2002, 08:42pm
BktBallRef BktBallRef is offline
Official Forum Member
 
Join Date: Aug 2000
Posts: 14,616
Files with the .scr extension are normally screen savers. However, viruses can come in the form of any extension. The attachments that I have received in the last week have come in the form of .zip, .exe, doc., etc. But they've all been forms of the W32.Klez worm. Anytime that you receive a file attachment that you were not expecting to receive, you should delete it. You can always contact the person and have them send it again if it was authentic.

Just because the Officials Choice is a reputable firm, it doesn't mean that they aren't susceptible to viruses, just like the rest of us. These worms infiltrate your address book. It then attaches itself to email messages and sends to everyone in the address book. If Chuck had previously communicated with them via email, then that is likely where the mesage came from. They would not be aware that the email had been transmitted.

Also, this worm effects AOL address books, not just MS Outlook and Outlook Express address books. 3 of the mailboxes that I received the virus from were AOL addresses. The other 4 were various other ISPs.

Here's a copy and paste from the Symantec.com information:

Due to an increased rate of submissions, Symantec Security Response is upgrading the threat level for W32.Klez.E@mm from level 2 to level 3 as of March 6, 2002.

W32.Klez.E@mm is similar to W32.Klez.A@mm. It is a mass-mailing email worm that also attempts to copy itself to network shares. The worm uses random subject lines, message bodies, and attachment file names.

The worm exploits a vulnerability in Microsoft Outlook and Outlook Express in an attempt to execute itself when you open or even preview the message in which it is contained. Information and a patch for the vulnerability are available at http://www.microsoft.com/technet/sec.../MS01-020.asp.

The worm overwrites files and creates hidden copies of the originals. In addition, the worm drops the virus W32.Elkern.3587, which is similar to W32.ElKern.3326.

The worm attempts to disable some common antivirus products and has a payload which fills files with all zeroes.

Reply With Quote