Someone has Klez

Who ever you are, you are flooding the NALW inbox with posts spoofing NELS' address....Norton AV is threatening to go on strike due to "overwork"...
Please check your systems....Who ever you are you have the NALW e-mail address and Nels' address at flightsim both in your address books....Your last two attacks were titledHappy new Allhallowmas
and
So cool a flash, Enjoy itAnybody else get on this dude's hit parade?Chuck Schneider
Chief Cook and Bottle Washer
North American Locomotive Works

Alert | IP

Printer-friendly page | Edit | Reply | Reply With Quote | Top

RE: Someone has Klez, highball5, Oct-25-02, 09:19 PM, (1) RE: Someone has Klez, I_totally_love_trains, Oct-25-02, 09:46 PM, (2) RE: Someone has Klez, Lone_Gunman_SG, Oct-27-02, 04:17 PM, (27) RE: Someone has Klez, robertreedy, Oct-25-02, 10:52 PM, (3) RE: Someone has Klez, derekmorton, Oct-26-02, 04:07 AM, (4) RE: Someone has Klez, cua193, Oct-26-02, 04:34 AM, (5) RE: Someone has Klez, robertreedy, Oct-26-02, 09:09 AM, (6) RE: Someone has Klez, I_totally_love_trains, Oct-26-02, 09:49 AM, (7) RE: Someone has Klez, CPR_Malice_96th, Oct-26-02, 10:16 AM, (8) RE: Someone has Klez, IcyFire, Oct-26-02, 10:19 AM, (9) RE: Someone has Klez, chucksc, Oct-26-02, 10:33 AM, (10) RE: Someone has Klez, IcyFire, Oct-26-02, 10:49 AM, (11) RE: Someone has Klez, cua193, Oct-26-02, 11:24 AM, (12) RE: Someone has Klez, DarkestRose, Oct-26-02, 11:24 AM, (13) RE: Someone has Klez, SCL, Oct-26-02, 12:15 PM, (14) RE: Someone has Klez, chucksc, Oct-26-02, 01:28 PM, (16) RE: Someone has Klez, chucksc, Oct-26-02, 01:26 PM, (15) RE: Someone has Klez, HAC, Oct-26-02, 01:42 PM, (17) RE: Someone has Klez, Cell0518, Oct-26-02, 05:00 PM, (18) Just recieved a msg today!, IcyFire, Oct-26-02, 05:22 PM, (19) RE: Just recieved a msg today!, robertreedy, Oct-26-02, 05:31 PM, (20) RE: Just recieved a msg today!, derekmorton, Oct-26-02, 08:00 PM, (21) RE: Just recieved a msg today!, SCL, Oct-27-02, 07:12 AM, (22) RE: Just recieved a msg today!, chucksc, Oct-27-02, 10:35 AM, (23) RE: Just recieved a msg today!, kevarc, Oct-27-02, 11:38 AM, (24) RE: Someone has Klez, mailer_daemon, Oct-27-02, 12:28 PM, (25) RE: Someone has Klez, SCL, Oct-27-02, 03:45 PM, (26) RE: Someone has Klez, chucksc, Oct-29-02, 04:51 PM, (29) RE: Someone has Klez, sn00py, Oct-29-02, 03:39 PM, (28) RE: Someone has Klez, SCL, Oct-30-02, 01:51 PM, (30) RE: Someone has Klez, sn00py, Oct-30-02, 08:54 PM, (31) RE: Someone has Klez, SCL, Oct-31-02, 05:21 PM, (32) RE: Someone has Klez, kevarc, Oct-31-02, 05:41 PM, (33) RE: Someone has Klez, IcyFire, Oct-31-02, 06:52 PM, (34) RE: Someone has Klez, BN_9402, Nov-01-02, 10:05 PM, (35) RE: Someone has Klez, robertreedy, Nov-01-02, 11:45 PM, (36) RE: Someone has Klez, chucksc, Nov-02-02, 12:56 PM, (37) RE: Someone has Klez, robertreedy, Nov-02-02, 02:43 PM, (38)

Conferences | Topics | Previous Topic | Next Topic

Haven't gotten any that I can say had any origination here, but the firewall/virus zapper
usually snags 15-20 klez infested items a week trying to sneak in from the net.

Alert | IP

Printer-friendly page | Edit | Reply | Reply With Quote | Top

Don't got it here, never had a virus either in my 4 years of computing besides false virus warnings caused by java software on a website. I don't answer junk mails or even open them so that's a good way to prevent viruses. That must be why Nels isn't answering his e-mail as fast anymore.Adam-------------------------------Operation Lifesaver Organization -- http://www.oli.org/
Striving to save lives at railroad crossings

-------------------------------

Alert | IP

Printer-friendly page | Edit | Reply | Reply With Quote | Top

Klez? whats that?
premium add-ons

Alert | IP

Printer-friendly page | Edit | Reply | Reply With Quote | Top

I don't know, but I've gotten a half-dozen or so the past couple of days that Norton identifies asW32.Yaha.F@Maddressed to my TS address, and they just keep coming. I'm just glad I paid my dues and have everything working correctly

RobertR .. ADF-M&RM at http://www.adfrr.com

Alert | IP

Printer-friendly page | Edit | Reply | Reply With Quote | Top

Chuck,This is more likely to be a bugbear infestation.
It is someone who uses outlook express or outlook.
And they don't know that they are infected.Derek (I use eudora)

Alert | IP

Printer-friendly page | Edit | Reply | Reply With Quote | Top

LAST EDITED ON Oct-26-02 AT 04:38 AM (EDT)

Chuck & others,I was hit by this virus the other week.The first symptoms were that programs locked up without reason, Norton kept switching itself off, the win shutoff failed & Internet Explorer started doing wierd things. There were also signs in Outlook Express that mail had been sent & returned - I rarely use OE for mail.Suspecting a virus, Norton didn't intercept the virus - Klez must immobilise Norton from the inside. Yes I do keep updated, I went to the Semantec site & virus checked online. This showed I had Klez. I downloaded their fix, followed the instructions to the letter & cleared my system.The most annoying thing was that I had been targeted, this wasn't from junk email, someone had addressed a mail to my flightsim site with a heading that I'd open. I then made the mistake of opening the attachment.I don't think I'd better say what I'd do to these people who think this is fun!!!!regards
Richard Osborne

Alert | IP

Printer-friendly page | Edit | Reply | Reply With Quote | Top

Richard, that's how most of these work. It's not that someone intentionally targeted you, but someone had your addy in their address book and was infected. Some of virii will go through and send some very believable messages to everyone in the address book without the person even being aware of it.

RobertR .. ADF-M&RM at http://www.adfrr.com

Alert | IP

Printer-friendly page | Edit | Reply | Reply With Quote | Top

Well I don't read Forward Messages anymore or accept online greeting cards so that's a first step to prevent lots of viruses.Adam-------------------------------Operation Lifesaver Organization -- http://www.oli.org/
Striving to save lives at railroad crossings

-------------------------------

Alert | IP

Printer-friendly page | Edit | Reply | Reply With Quote | Top

I am running McAffee right now to check for you ChuckLaterTim Kent

"Power for You"

Alert | IP

Printer-friendly page | Edit | Reply | Reply With Quote | Top

Hey Chuck, For a matter of fact, I have gotten e-mails with similar subject lines in my hotmail box, just so you know you not alone
Coming Soon: 2.53GHz, 1gig DDR Ram, ATI radeon 9700, All projects stoped until I get that system Built (3~4 weeks most)

Shawn "Icy-Fire" Kenselaar
ShawnSSK@Yahoo.com

Alert | IP

Printer-friendly page | Edit | Reply | Reply With Quote | Top

OK so that means the poor bastard has Shawn in his address book too!Hey Shawn its not your mom is it?Chuck Schneider
Chief Cook and Bottle Washer
North American Locomotive Works

Alert | IP

Printer-friendly page | Edit | Reply | Reply With Quote | Top

No, It's not my mother, I Keep this computer's virus scanner and firewall up to date, and I or any other users dont use outlook, so I dunno, Im not even sure that someone from train-sim is doing it to me, being a hotmail account, it's prone to crap like spam and virus'
Coming Soon: 2.53GHz, 1gig DDR Ram, ATI radeon 9700, All projects stoped until I get that system Built (3~4 weeks most)

Shawn "Icy-Fire" Kenselaar
ShawnSSK@Yahoo.com

Alert | IP

Printer-friendly page | Edit | Reply | Reply With Quote | Top

I'm afraid to say I was targeted, the suspect mail was sent to my flightsim site, the subject line referred to one of my aircraft & the mail addressed me by name.I learned my lesson about opening attachments though.I'm still nervous about mails, from trusted sources, which indicate an attachment but have none.Does anyone know a foolproof way of stopping junk mail? I don't want one, don't need any, can't afford them & don't live in the States!regards
Richard Osborne

Alert | IP

Printer-friendly page | Edit | Reply | Reply With Quote | Top

Chuck,Open email in outlook express, look at properties, it will give you the real origin of the email not the fake one. It's the easiest way to track down the person with the virus. You can copy and paste it to an email and send it to them to show them it is indeed them. It took me awhile to convince a friend that she had a virus, and when she finally did scan she found it and got rid of it.





"When you are with me I'm free
I'm careless, I believe
Above all the others we'll fly
This brings tears to my eyes
My Sacrifice"--Creed

Alert | IP

Printer-friendly page | Edit | Reply | Reply With Quote | Top

Not sure if I was/am the culprit.I was bombarded with Klez.32 about a month back - I could have up to 3 mails a day with attachments that looked suspicious. I deleted all except one I wasn't sure about, and I thought if I save it floppy then open it I'd be okay - WRONG. At the time I had eAnthology's anti-virus s/w running, but only in demo mode. The long and the short of it was that Klez screwed up OE, and obviously busily mailed itself to others as I had some mail returned - one was from Train-sim.com.Over the last few weeks I had repeated attacks, the mail all headed with MSTS-orientated titles, and all with attachments. Some of the headings had also been relevant to stuff I'd been dealing with in the past, so were excellent bait for me to open up.I now have eAnthology fully activated, plus Norton AV, and my system's been clean for the last week or so.I have occasional mail contact with NALW. I've warned some of the regular people who I mail, and no individual has got back to me to say that I'd sent infected mail, so I'm not sure if I'm behind the original reason for the first post. Lessons have been learned, and all-in-all it's been an expensive exercise for me!Apologies to anyone who has suffered an attack because of my ignorance.Cheers
Ken

Alert | IP

Printer-friendly page | Edit | Reply | Reply With Quote | Top

OK Ken 30 lashes with a wet noodle...
Have you got it cleaned out now?????
I Didn't get any today.Chuck Schneider
Chief Cook and Bottle Washer
North American Locomotive Works

Alert | IP

Printer-friendly page | Edit | Reply | Reply With Quote | Top

Rose I understand all that but when Norton says the e-mail is infected I just delete the thing without opening it. Period end of story... Its safer that way....Chuck Schneider
Chief Cook and Bottle Washer
North American Locomotive Works

Alert | IP

Printer-friendly page | Edit | Reply | Reply With Quote | Top

yeah, but my viruswall kills 'em before they ever hit my system...
HAC

Alert | IP

Printer-friendly page | Edit | Reply | Reply With Quote | Top

LAST EDITED ON Oct-26-02 AT 05:05 PM (EDT)

I am checking online. My IE has been doing some funky things lately.Thanks
Chris

Chris
MSTS Rocks
TA Please do 611 & 1218
Visit http://christrainsim.webhop.org

Alert | IP

Printer-friendly page | Edit | Reply | Reply With Quote | Top

Received: from out019.verizon.net (<206.46.170.98>) by mc7-f36.law1.hotmail.com with Microsoft SMTPSVC(5.0.2195.4905);
Sat, 26 Oct 2002 13:25:32 -0700
Received: from Tban (<66.95.107.130>) by out019.verizon.net
(InterMail vM.5.01.05.09 201-253-122-126-109-20020611) with SMTP
id <20021026202528.IXIY9549.out019.verizon.net@Tban>
for <shawnssk@hotmail.com>; Sat, 26 Oct 2002 15:25:28 -0500
From: hchfn <hchfn@msn.com>
To: shawnssk@hotmail.com
Subject: Happy good Allhallowmas
MIME-Version: 1.0
Content-Type: multipart/alternative;
boundary=Xc5ji25LCR
Message-Id: <20021026202528.IXIY9549.out019.verizon.net@Tban>
Date: Sat, 26 Oct 2002 15:25:32 -0500
Return-Path: hchfn@verizon.net
X-OriginalArrivalTime: 26 Oct 2002 20:25:32.0460 (UTC) FILETIME=--Xc5ji25LCR
Content-Type: text/html;
Content-Transfer-Encoding: quoted-printable<HTML><HEAD></HEAD><BODY>
<iframe src=3Dcid:K7r2b0fAu69SR69f0 height=3D0 width=3D0>
</iframe>
<FONT></FONT></BODY></HTML>--Xc5ji25LCR
Content-Type: audio/x-wav;
name=portrait_shelia<1>.bat
Content-Transfer-Encoding: base64
Content-ID: <K7r2b0fAu69SR69f0>
Those are the headers from the e-mail, It seems It was routed thru verizon, so somebody with verizon has it, anyone own this e-mail addy? hchfn@verizon.net
Coming Soon: 2.53GHz, 1gig DDR Ram, ATI radeon 9700, All projects stoped until I get that system Built (3~4 weeks most)

Shawn "Icy-Fire" Kenselaar
ShawnSSK@Yahoo.com

Alert | IP

Printer-friendly page | Edit | Reply | Reply With Quote | Top

Here's another one in case somebody recognizes itThe person with this email address annika_sedek@hotmail.com probably has the virus and doesn't even realize it
proto=SMTP, relay=CPE014100206912.cpe.net.cable.rogers.com <24.103.206.252>
<XX>Oct 24 18:57:19 sendmail<83020>: g9P1vG183013: to=<robertr@adfrr.com>, ctladdr=<MAILER-DAEMON@adfrr.com> (23163/100), delay=00:00:03, xdelay=00:00:00, mailer=local, pri=69939, dsn=2.0.0, stat=Sent

RobertR .. ADF-M&RM at http://www.adfrr.com

Alert | IP

Printer-friendly page | Edit | Reply | Reply With Quote | Top

Guys,Both klez and bugbear fake the from address.
They take the domain from one address and put in the name from another.
Neither email addresses are real. What is real though is the mail server the mail is coming from.That is your only clue.Roberts came from a Rogers cable user.
Shawns isn't traceing at the moment.Derek

Alert | IP

Printer-friendly page | Edit | Reply | Reply With Quote | Top

Hi ChuckMy system's totally clean according to NAV and eAnthology.The scary thing about all this is that some of the "suspicious" looking mail with attachments looked temptingly genuine. The subject headings included sentences like: "you will need this for the latest activity", and "re: DekoSoft SCL#1404" or such like. That last one is a loco I worked on. Not recognising any of the senders or their addresses I deleted them straight away as I've not really been actively involved with the A-Line or any other projects for a few months now, also reasoning that a message would follow if the mail and attachment was genuine.I have saved mail over the last year or so, and I figured that maybe the virus has gone through these saved files and randomly attached itself to old mail and re-sent itself. Anyone know if this is likely?Anyway, I've passed on the punishment instructions you suggested to my wife. She wants to know if spaghetti will do as we're fresh out of noodles? Cheers
Ken

Alert | IP

Printer-friendly page | Edit | Reply | Reply With Quote | Top

Spagetti is cool!
Just make sure she cooks it first....
Besides if you are going Italian look at all the "fun" you can have with olive oil!
Chuck Schneider
Chief Cook and Bottle Washer
North American Locomotive Works

Alert | IP

Printer-friendly page | Edit | Reply | Reply With Quote | Top

The old email address I had here has been getting the anna email's. It was the AOL one, The got through the AOL firewall. Never opened them so I did not get infected. I notified AOL that they were letting them through. So add kjsarc@aol.com to the list that an attempt was made. Kevin Arceneaux
gdapia

Alert | IP

Printer-friendly page | Edit | Reply | Reply With Quote | Top

http://www.sarc.com/avcenter/venc/data/w32.klez.h@mm.html for the full details on the Klez virus...The virus is capable of faking email addresses, so beware.

http://koti.mbnet.fi/rogorox/

Alert | IP

Printer-friendly page | Edit | Reply | Reply With Quote | Top

Hey ChuckI'll take your advice re: cooking the spaghetti first (is this first hand experience?), but I'll leave olive oil to popeye if you don't mind <vbg>Cheers
Ken

Alert | IP

Printer-friendly page | Edit | Reply | Reply With Quote | Top

Olive Oil is Kool!
I like skinny chicks!
Chuck Schneider
Chief Cook and Bottle Washer
North American Locomotive Works

Alert | IP

Printer-friendly page | Edit | Reply | Reply With Quote | Top

Bingo!I wondered what that allhallowmass thing was. Deleted it without opening the thing.Being druid, I know it's samhain...not allhallowmass.

Alert | IP

Printer-friendly page | Edit | Reply | Reply With Quote | Top

Yes, but being titled "allhallowmass" that would make it Christian, not pagan, wouldn't it? I know Samain historically came first though! Seriously, are you a modern druid?Cheers
Ken

Alert | IP

Printer-friendly page | Edit | Reply | Reply With Quote | Top

Last question first. "Yeah. More of a modern Celt than anything. Fifty fifty mix of paganism and christianity."As to the first, thechnically you're right. But as the christian faith became popular in Britian, Scotland, and Ireland, over time the name All hallow Mass became synonymous (hard word to spell) with samhain. Just as the term Halloween is a derivitave of "Hallow's Eve." or the day before Hallow Mass.Samhain is actually later than the 31st, but most dru tend to celebrate it on that day anyway. Especially if it falls on a weekend.

Alert | IP

Printer-friendly page | Edit | Reply | Reply With Quote | Top

InterestingI always find it amusing to see how many Christian religious ceremonies "coincide" with the pagan ones! I thought Samain fell on November 1st, although in Scotland it falls on the 11th (old calendar).Cheers
Ken

Alert | IP

Printer-friendly page | Edit | Reply | Reply With Quote | Top

This sucker is still out there, it is bombarding my old email at AOL. New twist though, it is coming as a returned email.Kevin Arceneaux
gdapia

Alert | IP

Printer-friendly page | Edit | Reply | Reply With Quote | Top

yep, got the same crap at my yahoo mail now too
Coming Soon: 2.53GHz, 1gig DDR Ram, ATI radeon 9700, All projects stoped until I get that system Built (3~4 weeks most)

Shawn "Icy-Fire" Kenselaar
ShawnSSK@Yahoo.com

Alert | IP

Printer-friendly page | Edit | Reply | Reply With Quote | Top

Another AOL/Rogers customer caught in my inbox this evening:From - Fri Nov 01 21:04:08 2002
X-Mozilla-Status: 0001
X-Mozilla-Status2: 00000000
Return-Path: <aniccab_13@hotmail.com>
Received: from rly-nb03.mx.aol.com (rly-nb03.mail.aol.com <172.20.65.131>) by air-nb05.mail.aol.com (v89.10) with ESMTP id MAILINNB52-1030214219; Wed, 30 Oct 2002 21:42:19 -0400
Received: from mailin-01.mx.netscape.net (cpe014100206912.cpe.net.cable.rogers.com <24.103.207.229>) by rly-nb03.mx.aol.com (v89.10) with ESMTP id MAILRELAYINNB38-1030214200; Wed, 30 Oct 2002 21:42:00 -0400
From: aniccab_13<aniccab_13@hotmail.com>
To: kcs2013@netscape.net
Subject: Fw: Wonderfool relations to share !!
Date: Wed,30 Oct 2002 21:42:08 PM
X-Mailer: Microsoft Outlook Express 5.50.4133.2400
MIME-Version: 1.0
Content-Type: multipart/mixed;
boundary=ptiiwdo
Message-ID: <200210302142.08VGSCa009862@rly-nb03.mx.aol.com>Austin S.
kcs2013@netscape.net
Milwaukee Road's Pacific Coast Extension Group
http://groups.yahoo.com/group/milwpaccoastextension/
Milwaukee Road's Trans-Missouri Division
Version 0.2

Alert | IP

Printer-friendly page | Edit | Reply | Reply With Quote | Top

This is the same provider I'm getting these from also and today even had the same return path. cpe.net.cable.rogers.comHave been getting one or two almost every day.

RobertR .. ADF-M&RM at http://www.adfrr.com

Alert | IP

Printer-friendly page | Edit | Reply | Reply With Quote | Top

Then forward them to abuse@rogers.net (I think that is the correct address) copy to the abuse address for your ISP.
Even if they are being spoofed Rogers has a lot more resources to deal with this than you do!Chuck Schneider
Chief Cook and Bottle Washer
North American Locomotive Works

Alert | IP

Printer-friendly page | Edit | Reply | Reply With Quote | Top

Thanks Chuck, I wasn't sure what avenue to take.

RobertR .. ADF-M&RM at http://www.adfrr.com

Alert | IP

[ Home | MSTS Forum | MSTS FAQ | File Library ] Copyright © 2002 by Nels Anderson. All Rights Reserved.