AndyC_772

iTrader: (2)

I've just received an email from an address in the imgroup.co.uk domain, which includes a virus called WORM_KLEZ.G.

imgroup.co.uk is International Motors, so I guess other people on Scoobynet might be on the same mailing list or address book and could therefore be targeted.

My office firewall filtered the virus out, so I can't offer any advice on how to get rid of it manually

Andy.

Maz-old

Cheers mate.

suffolkscoob

Thanks for that

JackClark

If you're using McAfee Antivirus and you've updated in the last 3 months you're protected.

Dave T-S

If I get infected, is it covered by my warranty?

Dave T-S

PS - I haven't "imported" the virus......

MattW

Did you modify it? and have you kept to the servicing schedule?

AndyC_772

iTrader: (2)

Oddly enough, Dave, the subject of the message was "WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESS" - so I guess that means 'no'

The Zohan

Apparently Prodrive are looking into an upgrade which should increase is performance so it ***** up your pc even quicker

Thanks for the warning

Paul

Beastie

iTrader: (2)

I received this today with an attachment. I didnt download the attachment as it is clearly very Suspect.I have never heard of the sender.

Subj: A special new game
Date: 4/19/02 1:55:29 PM W. Europe Daylight Time
From: fkreuger@pmcoetwil.ch
To: ScoobyinScotland@aol.com
File: demo.zip (53771 bytes) DL Time (32000 bps): < 1 minute
Sent from the Internet (Details)



This is a very new game
This game is my first work.
You're the first player.
I wish you would like it.

Dave T-S

LOL

(not at Beastie, the previous posts)

[Edited by Dave T-S - 4/19/2002 3:56:57 PM]

Jer

VIRUS ALERT

There is a new virus in circulation with the key details as follows:


Virus name: Klez.H

Official name: W32/Klez.H-mm

Number of copies seen so far: 40591

Time & Date first Captured: 15 Apr 2002

Origin of first intercepted copy: China

Number of countries seen active: 131

Top three most active countries: Hong Kong (4321), Great Britain (3900), United States (3524)




Technical Details:

Subject title, attachment name and body text:

Subject: Random
Message Body: Random
Attachment: Random


Virus Behaviour:

Once executed the worm searches the Windows address book, ICQ database, and local files for email addresses then it sends an email message to these addresses with itself as an attachment. The worm contains its own SMTP engine. The from address is spoofed and is made up of an email address it has found within the infected computer, thus making it harder to trace.


Payload:

Drops a version of PE_ELKERN.D into usually C:\Program Files (this attachment has a random filename)

mutant_matt

...but the Prodrive version of the Virus costs twice as much as other "tuned" versions of the Virus....

Matt

Brendan Hughes

If it's from IM, doesn't that mean that Dave T-S will get two of the latest versions?

Yorkie

Does it come with standard bugeyes or morettes ?

Thanx for the warning

Yorkie

Dave T-S

LOL @ Brendan

catflap

Mrs Catflap here....

Beastie,

I have had loads of viruses come through to my works computer this week, one of them being the one you have had about the new game.

Don't open it, our office firewall killed mine, but apparantly it's not a very nice virus!

Ali

STi wanna Subaru

iTrader: (1)

It got our Company today

john banks

Beastie I was sent the same one today and did the same with it.