It's amazing what can happen when one little letter is changed.
I moved the virus scanner to a different maching Sunday and failed to change
the location of the F-Prot executable.
The log file told the story.
05/27/2003 00:05:08 Qf20211a Scanned: Error starting scanner
05/27/2003 00:05:11
I think my users are getting bombarded with klez. The email is as follows
Hi,
I just came across this funny screensaver..
sending it to u.. hope u like it..
check out and die laughing.. :)
Actually, I believe that is Yaha.
Klez.H is the most common world-wide spreading worm.It's very
, January 03, 2003 8:25 AM
Subject: Re: [Declude.Virus] Klez?
I think my users are getting bombarded with klez. The email is as
follows
Hi,
I just came across this funny screensaver..
sending it to u.. hope u like it..
check out and die laughing.. :)
Actually, I believe that is Yaha
I noticed my mcafee desktop scanner is not getting it either and I just
bought this version
- Original Message -
From: R. Scott Perry [EMAIL PROTECTED]
To: [EMAIL PROTECTED]
Sent: Friday, January 03, 2003 8:25 AM
Subject: Re: [Declude.Virus] Klez?
I think my users are getting bombarded
I noticed my mcafee desktop scanner is not getting it either and I just
bought this version
In that case, it may be that they are corrupt, non-viable variants of the
original virus. Some viruses will become corrupt for some reason (either
due to the virus itself, or the way it bounces),
]
- Original Message -
From: Matthew Lohr [EMAIL PROTECTED]
To: [EMAIL PROTECTED]
Sent: Friday, January 03, 2003 8:36 AM
Subject: Re: [Declude.Virus] Klez?
i just put the latest version of declude in v1.65 like 5 minutes ago. I
believe i had 1.62 running before that. Other viruses
My question is regarding the reported remote ip address - the ip address
reported using the %remoteip% is that the actually ip address of the
computer sending the virus or is that also forged by the virus?
The IP address cannot be forged by the virus, so it will always be correct.
Is anyone else being drove to insanity by klez?
Klez is nasty. Very nasty.
We are catching the virus, but that doesn't stop everyone else on different
Isp's thinking we are sending them because of the spoofed from address.
And that's the problem. Although Declude Virus now has the ability
It is insane!
And the spoofing is a pain in the butt also.
The volume of them is just incredible.
Harry Vanderzand
-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED]]On Behalf Of Kenneth Bird
Sent: Thursday, May 16, 2002 12:37 PM
To: [EMAIL PROTECTED]
Subject:
A further point on this.
We have had incidents of our postmaster account being the spoofed address that is used.
Does anyone have any ideas how Klez is doing this?
Harry
-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED]]On Behalf Of Kenneth Bird
Sent: Thursday, May
We have had incidents of our postmaster account being the spoofed address
that is used.
Does anyone have any ideas how Klez is doing this?
Klez sometimes makes up addresses, by combining a known username with a
known hosthame. So if you have [EMAIL PROTECTED] and
[EMAIL PROTECTED] in your
11 matches
Mail list logo
