This virus has its own email system the reason why your admins are recieving
messages from you is probable cause someone you know has the virus on their
machine. The virus will then use the infected users address book and send
as those contacts.
-Original Message-
From: Sander Van
Substitute the word virus for user, and voila ... proliferation :)
-Original Message-
From: Tener, Richard [mailto:[EMAIL PROTECTED]]
Sent: 23 April 2002 14:31
To: Exchange Discussions
Subject: RE: WORM_KLEZ.G Sever Impact
This virus has its own email system the reason why your admins
If you had read the tech specs on that virus, you would've know that it does
spoof email addresses. Any admin who contacts you and claims that you're
sending them viruses also has not read the specifications of this virus.
They also have no idea on how to decipher (or even locate) SMTP header
Did you do any research on the virus?
From Symantec's site:
The From address is randomly-chosen from email addresses that the worm
finds on the infected computer.
That's why.
-Original Message-
From: Sander Van Butzelaar [mailto:[EMAIL PROTECTED]]
Sent: Tuesday, April 23, 2002 8:04 AM
euhhh
if there is a way to stop these messages coming in let me know, 'cause
Im getting like 100/hour for 4 days now...
-Original Message-
From: Candee Vaglica [mailto:[EMAIL PROTECTED]]
Sent: 23 April, 2002 3:11 PM
To: Exchange Discussions
Subject: RE: WORM_KLEZ.G Sever Impact
Did
Schotanus [mailto:[EMAIL PROTECTED]]
Sent: Tuesday, April 23, 2002 8:42 AM
To: Exchange Discussions
Subject: RE: WORM_KLEZ.G Sever Impact
euhhh
if there is a way to stop these messages coming in let me know, 'cause
Im getting like 100/hour for 4 days now...
-Original Message-
From: Candee
I don't see a pattern in the originators...
Guess I'll just have to sit it out...
-Original Message-
From: Bob Sadler [mailto:[EMAIL PROTECTED]]
Sent: 23 April, 2002 3:37 PM
To: Exchange Discussions
Subject: RE: WORM_KLEZ.G Sever Impact
If the same person is sending these in, just put
you are getting the e-mail from, and disabled mail coming in from that
particular domain. That's what I have done anyway.
Chris Callan
-Original Message-
From: Bob Sadler [mailto:[EMAIL PROTECTED]]
Sent: Tuesday, April 23, 2002 9:37 AM
To: Exchange Discussions
Subject: RE: WORM_KLEZ.G Sever
be blissfully unaware of a problem which makes me ask the question...
-Original Message-
From: Kim Schotanus [mailto:[EMAIL PROTECTED]]
Sent: 23 April 2002 14:51
To: Exchange Discussions
Subject: RE: WORM_KLEZ.G Sever Impact
I don't see a pattern in the originators...
Guess I'll just have
[mailto:[EMAIL PROTECTED]]
Sent: Tuesday, April 23, 2002 9:47 AM
To: Exchange Discussions
Subject: RE: WORM_KLEZ.G Sever Impact
Am I missing something here? According to my AV vendor, signatures from
January detect and clean this thingThere seem to be 2 variants, KLEZ.G
and KLEZ.H and both
8:42 AM
To: Exchange Discussions
Subject: RE: WORM_KLEZ.G Sever Impact
euhhh
if there is a way to stop these messages coming in let me know, 'cause
Im getting like 100/hour for 4 days now...
-Original Message-
From: Candee Vaglica [mailto:[EMAIL PROTECTED]]
Sent: 23 April, 2002 3:11 PM
: Tuesday, April 23, 2002 9:55 AM
To: Exchange Discussions
Subject: RE: WORM_KLEZ.G Sever Impact
AhaNow I see. Looks like I got off lightly then as I have had no reports
of this one from any of my users.
PPHHWW!
Thanks
Dominic.
-Original Message-
From: Etts, Russell [mailto:[EMAIL
in windows media player disable the extension associated with the program or
put your internet security level on high.
-Original Message-
From: Etts, Russell [mailto:[EMAIL PROTECTED]]
Sent: Tuesday, April 23, 2002 9:51 AM
To: Exchange Discussions
Subject: RE: WORM_KLEZ.G Sever Impact
. Then they fight you. Then
you win. --Mahatma Gandhi
-Original Message-
From: Kim Schotanus [mailto:[EMAIL PROTECTED]]
Sent: Tuesday, April 23, 2002 9:51 AM
To: Exchange Discussions
Subject: RE: WORM_KLEZ.G Sever Impact
I don't see a pattern in the originators...
Guess I'll just have
It's not supposed to do that!
James Winzenz, MCSE, A+
Associate Systems Administrator
Peregrine Systems, Inc.
-Original Message-
From: Chris Levis [mailto:[EMAIL PROTECTED]]
Sent: Thursday, April 18, 2002 9:28 AM
To: Exchange Discussions
Subject: RE: WORM_KLEZ.G
CDW has the lowest
It worked when I did it
-Original Message-
From: James Winzenz [mailto:[EMAIL PROTECTED]]
Sent: Thursday, April 18, 2002 9:54 AM
To: Exchange Discussions
Subject: RE: WORM_KLEZ.G
It's not supposed to do that!
James Winzenz, MCSE, A+
Associate Systems Administrator
Peregrine Systems
It's a beta, what did you expect?
James Winzenz, MCSE, A+
Associate Systems Administrator
Peregrine Systems, Inc.
-Original Message-
From: Andy David [mailto:[EMAIL PROTECTED]]
Sent: Thursday, April 18, 2002 9:57 AM
To: Exchange Discussions
Subject: RE: WORM_KLEZ.G
It worked when I
It's not a bug, it's a feature!
-Original Message-
From: James Winzenz [mailto:[EMAIL PROTECTED]]
Sent: Thursday, April 18, 2002 9:59 AM
To: Exchange Discussions
Subject: RE: WORM_KLEZ.G
It's a beta, what did you expect?
James Winzenz, MCSE, A+
Associate Systems
It burns when I pee
-Original Message-
From: Andy David [mailto:[EMAIL PROTECTED]]
Sent: Thursday, April 18, 2002 6:57 AM
To: Exchange Discussions
Subject: RE: WORM_KLEZ.G
It worked when I did it
-Original Message-
From: James Winzenz [mailto:[EMAIL PROTECTED]]
Sent
-
From: Martin Blackstone [mailto:[EMAIL PROTECTED]]
Sent: Thursday, April 18, 2002 10:20 AM
To: Exchange Discussions
Subject: RE: WORM_KLEZ.G
It burns when I pee
-Original Message-
From: Andy David [mailto:[EMAIL PROTECTED]]
Sent: Thursday, April 18, 2002 6:57 AM
To: Exchange Discussions
Message-
From: Mood, Steve [mailto:[EMAIL PROTECTED]]
Sent: Wednesday, April 17, 2002 12:22 PM
To: Exchange Discussions
Subject: RE: WORM_KLEZ.G
And please stop yelling or fix your shift key.
-Original Message-
From: Mood, Steve
Sent: Wednesday, April 17, 2002 12:17 PM
To: Exchange
A new version of NAV-GW, or a new definition file? Using NAV-GW
2.5.1.18 here.
-Original Message-
From: Candee Vaglica [mailto:[EMAIL PROTECTED]]
Posted At: Wednesday, April 17, 2002 11:31 AM
Posted To: MSExchange Mailing List
Conversation: WORM_KLEZ.G
Subject: RE: WORM_KLEZ.G
Message-
From: Andy David [mailto:[EMAIL PROTECTED]]
Sent: Wednesday, April 17, 2002 11:26 AM
To: Exchange Discussions
Subject: RE: WORM_KLEZ.G
I was under the impression that the extension is random.
-Original Message-
From: WILLIAMS,JESSICA D [mailto:[EMAIL PROTECTED]]
Sent: Wednesday
:[EMAIL PROTECTED]]
Sent: Wednesday, April 17, 2002 12:35 PM
To: Exchange Discussions
Subject: RE: WORM_KLEZ.G
A new version of NAV-GW, or a new definition file? Using NAV-GW 2.5.1.18
here.
-Original Message-
From: Candee Vaglica [mailto:[EMAIL PROTECTED]]
Posted At: Wednesday, April 17
Of course you do!
-Original Message-
From: Candee Vaglica [mailto:[EMAIL PROTECTED]]
Sent: Wednesday, April 17, 2002 12:31 PM
To: Exchange Discussions
Subject: RE: WORM_KLEZ.G
If you're using NAV for Gateways to do the blocking, it doesn't recognize
the attachments; they have a new
To: Exchange Discussions
Subject: RE: WORM_KLEZ.G
OK, Steve you deserve the geek of the week for the Stop Yelling comment.
Come on dude. I expect a bit more from this list than to stoop that low.
___
John Bowles
Exchange Administrator
Enterprise Support Engineering
Celera Genomics
Tom,
The new version is 2.5.2.9 (for NT)
-Original Message-
From: Candee Vaglica [mailto:[EMAIL PROTECTED]]
Sent: Wednesday, April 17, 2002 12:40 PM
To: Exchange Discussions
Subject: RE: WORM_KLEZ.G
A new version of the GW; you might be alright, but I'm at .13, and the tech
is e
Just thought I'd pass on some info to him that wasn't already in the FAQ.
Duly noted.
-Original Message-
From: Soysal, Serdar [mailto:[EMAIL PROTECTED]]
Sent: Wednesday, April 17, 2002 12:44 PM
To: Exchange Discussions
Subject: RE: WORM_KLEZ.G
Besides, it wasn't his fault. It's part
Subject: RE: WORM_KLEZ.G
If I am reading this article correctly, then it will have a random extension
if it is a earlier variation of KLEZ. This particular version has either
.exe or a double extension. Please correct me if I'm wrong.
http://www.viruslist.com/eng/viruslist.html?id=4292
Jessica
Subject: RE: WORM_KLEZ.G
I've seen some klez-g messages with bat and scr attachments. Of course there
may be disagreement on exactly what constitutes the G variant.
-Peter
-Original Message-
From: WILLIAMS,JESSICA D [mailto:[EMAIL PROTECTED]]
Sent: Wednesday, April 17, 2002 9:35
Discussions
Subject: RE: WORM_KLEZ.G
I've seen some klez-g messages with bat and scr attachments. Of course there
may be disagreement on exactly what constitutes the G variant.
-Peter
-Original Message-
From: WILLIAMS,JESSICA D [mailto:[EMAIL PROTECTED]]
Sent: Wednesday, April 17, 2002 9:35
PM
To: Exchange Discussions
Subject: RE: WORM_KLEZ.G
I'm afraid you've gone and mystified me. If you're blocking all those
filetypes, how can Klez get through to open Windows Media Player?
-Peter
-Original Message-
From: Tener, Richard [mailto:[EMAIL PROTECTED]]
Sent: Wednesday, April 17
I dont know if I anyone is infected or not we just keep receiving a ton of
emails with viruses in them.
-Original Message-
From: Sandhya Pai [mailto:[EMAIL PROTECTED]]
Sent: Wednesday, April 17, 2002 3:48 PM
To: Exchange Discussions
Subject: RE: WORM_KLEZ.G
I've seen that happen here
Dont you get paid to find out if anyone is infected or not?
-Original Message-
From: Tener, Richard [mailto:[EMAIL PROTECTED]]
Sent: Wednesday, April 17, 2002 3:57 PM
To: Exchange Discussions
Subject: RE: WORM_KLEZ.G
I dont know if I anyone is infected or not we just keep receiving
Why you no answer my question??
Quack!
-Original Message-
From: Andy David [mailto:[EMAIL PROTECTED]]
Sent: Wednesday, April 17, 2002 1:01 PM
To: Exchange Discussions
Subject: RE: WORM_KLEZ.G
Dont you get paid to find out if anyone is infected or not?
-Original Message
scan is virus scanning, and incoming Klezes are
detected as such and purged, rather than just having their attachments removed.
-Peter
-Original Message-
From: Sandhya Pai [mailto:[EMAIL PROTECTED]]
Sent: Wednesday, April 17, 2002 12:48
To: Exchange Discussions
Subject: RE: WORM_KLEZ.G
Thats the virus softwares job we pay him good money to do this. He told me
that no one is infected.
-Original Message-
From: Martin Blackstone [mailto:[EMAIL PROTECTED]]
Sent: Wednesday, April 17, 2002 4:24 PM
To: Exchange Discussions
Subject: RE: WORM_KLEZ.G
Why you no answer my
To: Exchange Discussion List
Conversation: WORM_KLEZ.G
Subject: RE: WORM_KLEZ.G
Thats the virus softwares job we pay him good money to do this. He told
me that no one is infected.
-Original Message-
From: Martin Blackstone [mailto:[EMAIL PROTECTED]]
Sent: Wednesday, April 17, 2002 4:24 PM
38 matches
Mail list logo
