Klez Virus

Todd Martin todd at DECAGON.COM
Fri May 17 00:01:25 IST 2002


Are you sure the html, jpeg, and png files are really infected?

In my experience, one of the Klez variants attaches a copy of itself
_and_ a random file from the infected computer's hard drive. This
random file is unaltered (i.e. "clean"). I've seen several infected
emails where MailScanner with Sophos removes the virus, but passes on
the extra attached file (with bad mime boundaries, but who cares).

~Todd

>The Klez virus is attaching as HTM/JPG/PNG files and the MailScanner
>can not find it.
>
>Do I change that in MailScanner or my Antivirus?
>--------------------------------------------------------------
>Kham Vue
>Internet Admin
>The City of Wadsworth
>WADSNET.COM High Speed Internet Service
>kvue at wadsnet.com
>  "Believe that life is worth living, and your belief will help
>create the fact."
>       --William James



More information about the MailScanner mailing list