>Is anyone else being drove to insanity by klez?
Klez is nasty. Very nasty.
>We are catching the virus, but that doesn't stop everyone else on different
>Isp's thinking we are sending them because of the spoofed from address.
And that's the problem. Although Declude Virus now has the ability
It is insane!
And the spoofing is a pain in the butt also.
The volume of them is just incredible.
Harry Vanderzand
-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED]]On Behalf Of Kenneth Bird
Sent: Thursday, May 16, 2002 12:37 PM
To: [EMAIL PROTECTED]
Subject: [Declud
A further point on this.
We have had incidents of our postmaster account being the spoofed address that is used.
Does anyone have any ideas how Klez is doing this?
Harry
-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED]]On Behalf Of Kenneth Bird
Sent: Thursday, May 1
>We have had incidents of our postmaster account being the spoofed address
>that is used.
>
>Does anyone have any ideas how Klez is doing this?
Klez sometimes makes up addresses, by combining a known username with a
known hosthame. So if you have "[EMAIL PROTECTED]" and
"[EMAIL PROTECTED]" i
I think my users are getting bombarded with klez. The email is as follows
Hi,
I just came across this funny screensaver..
sending it to u.. hope u like it..
check out and die laughing.. :)
Actually, I believe that is Yaha.
Klez.H is the most common world-wide spreading worm.It's very danger
IL PROTECTED]>
Sent: Friday, January 03, 2003 8:25 AM
Subject: Re: [Declude.Virus] Klez?
>
> >I think my users are getting bombarded with klez. The email is as
follows
> >
> >Hi,
> >I just came across this funny screensaver..
> >sending it to u.. hope u like it..
>
I noticed my mcafee desktop scanner is not getting it either and I just
bought this version
- Original Message -
From: "R. Scott Perry" <[EMAIL PROTECTED]>
To: <[EMAIL PROTECTED]>
Sent: Friday, January 03, 2003 8:25 AM
Subject: Re: [Declude.Virus] Klez?
>
> &
I noticed my mcafee desktop scanner is not getting it either and I just
bought this version
In that case, it may be that they are "corrupt, non-viable" variants of the
original virus. Some viruses will become corrupt for some reason (either
due to the virus itself, or the way it bounces), al
]
- Original Message -
From: "Matthew Lohr" <[EMAIL PROTECTED]>
To: <[EMAIL PROTECTED]>
Sent: Friday, January 03, 2003 8:36 AM
Subject: Re: [Declude.Virus] Klez?
> i just put the latest version of declude in v1.65 like 5 minutes ago. I
> believe i had 1.62
CTED]>
To: <[EMAIL PROTECTED]>
Sent: Friday, January 03, 2003 8:50 AM
Subject: Re: [Declude.Virus] Klez?
>
> >I noticed my mcafee desktop scanner is not getting it either and I just
> >bought this version
>
> In that case, it may be that they are "corrupt, non-viable&
I also notice that i am catching the yaha virus here
01/02/2003 23:15:17 Q0e54295d0102fff4 File(s) are INFECTED [3]
01/02/2003 23:15:17 Q0e54295d0102fff4 Scanned: CONTAINS A VIRUS [MIME: 2
29989]
but at 8:06 pm last night it also came through as the logs show nothing
01/02/2003 19:48:13 Qddcc
>Is it possible to filter out certain recipients for virus notifications?
There isn't any way to do this currently, but it is something that we will
likely be adding to an upcoming release.
-Scott
---
[This E-mail was scanned for viruses by Declude Virus (http://www.de
We're
stopping tons with the same sender address too. After the first
couple dozen I decided the user must actually have the virus. We knew
them, contacted them by phone and explained the problem. They were/are
totally clueless and have no idea how to go about getting virus software and
>My question is regarding the reported remote ip address - the ip address
>reported using the %remoteip% is that the actually ip address of the
>computer sending the virus or is that also forged by the virus?
The IP address cannot be forged by the virus, so it will always be correct.
It's amazing what can happen when one little letter is changed.
I moved the virus scanner to a different maching Sunday and failed to change
the location of the F-Prot executable.
The log file told the story.
"05/27/2003 00:05:08 Qf20211a Scanned: Error starting scanner
05/27/2003 00:05:11 Qf2060
>Does the email get scanned for virii before Spam?
Yes, E-mail is scanned for viruses before it is scanned for spam.
-Scott
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
This E-mail came from the Declude.Virus mailing l
16 matches
Mail list logo
