new variants, VERY destructive "MyLife"/"Klez" virus

Automated PC Solutions
VACM - Virus Alerts for the Common Man

get it now: #1 AntiSpyware #1 AntiVirus #1 Personal Firewall

VACM Home VACM Links APCS Home

bookmark this page:

new variants, VERY destructive "MyLife"/"Klez" virus

Your old boxes are worth CASH $$... Click to learn more...

Electronics
Bargains

VACM Home

VACM How-To Movie: Learn how to Remove Spyware from your PC for free (really!). Click to Watch the video.

Greetings from The VACM Team,

In this issue: (UPDATED)
------------------------------------
- VERY destructive "MyLife"/"KLEZ" virus spreading faster
than Code Red and Nimda combined! No slowdown in sight!
KLEZ is the #1 most encountered virus this year!
Find out how to protect your system(s) here.

***************************************************
* The Bottom Line...
***************************************************
New variants of the "MyLife" worm virus are running rampant in
people's inboxes. W32/Klez.H and W32/Klez.I are mass-mailing
worms. The worm sends itself to everyone in your address books.

It will DELETE FILES from your system and can shut down
antivirus and other software.

Klez takes advantage of an Internet Explorer vulnerability
which allows attached files to be run automatically simply by
opening the corresponding message or viewing it through
your email software's preview pane.

The email carrying the worm virus will typically have one of
the following subjects:

A new website
Introduction on ADSL
Fwd:virus,Japanese lass' sexy pictures
A very new game
NOSHADE CLASS

The body of the message reads as follows:

This is a new website.I wish you would like it

or,

This game is my first work.
You're the first player.
I hope you would enjoy it.

***************************************************
* DON'T BELIEVE EVERY EMAIL YOU GET...
***************************************************
To make matters worse, someone has started circulating an email
that claims to be a cure for Klez.
Don't be fooled into believing that someone is sending you a cure
for the Klez worm. If you get the following email, do NOT
follow its instructions, do NOT double-click the attachment,
DELETE the email. The supposed "cure" is really the Klez Virus!!

+-----------------------------------------------------
| Subject: Worm Klez.E immunity
|
| Body:
| Klez.E is the most common world-wide spreading worm.It's very
| dangerous by corrupting your files.
| Because of its very smart stealth and anti-anti-virus
| technic,most common AV software can't detect or clean it.
| We developed this free immunity tool to defeat the malicious
| virus.
| You only need to run this tool once,and then Klez will never
| come into your PC.
| NOTE: Because this tool acts as a fake Klez to fool the real
| worm,some AV monitor maybe cry when you run it.
| If so,Ignore the warning,and select 'continue'.
| If you have any question,please mail to me.
+-------------------------------------------------------

The attachment will have either a BAT, EXE, PIF, or SCR extension.
If you have not disabled hiding of file extensions, you will not
know that the attachment is an executable file. To disable the
hiding of file extensions, please refer to our HowTo article at:

Don't Let Windows Hide your File Extensions

***************************************************
* What You Should Do...
***************************************************
1. Get the best antivirus software available today (see next section for
info on what to get)

2. Update your antivirus software's virus definitions daily.

3. Patch Internet Explorer so that you are not vulnerable to this
type of infected email. If you did not apply the Microsoft
patches to Internet Explorer when we wrote about their
availability, please refer back to that VACM Alert at:

IE Cumulative Patches

4. Turn off your "Preview Pane" now and always.
If you haven't already done all of our "How To" articles to
harden your system against these types of viruses, now might be
a good time to consider it. They can be found at the VACM Archives:

The VACM Archives

***************************************************
* Get the Best Protection from Klez
* and other self-running viruses...
***************************************************
Our tests indicate that the email scanning technology in Norton Antivirus 2002
is hands down the best on the market today. If you have a previous version of
Norton Antivirus, we recommend that you DO NOT simply renew your virus definitions
subscription! Get a copy of Norton Antivirus 2002 for the most complete protection.

If you upgrade to Norton Antivirus 2002, from a previous version of Norton or from
another product altogether, do the following steps to upgrade your antivirus product:

1. disconnect from the internet and your local network (if you have one)
2. Uninstall the old antivirus product
3. Reboot your machine
4. Install NAV 2002
5. Reboot your machine
6. Run LiveUpdate repeatedly until NAV tells you that "all products are up to date"
7. Do a full system scan
8. Reconnect your system to your network

***************************************************
* If You Get Infected
***************************************************
1. Visit the Symantec site and get the Klez Removal Tool and instructions
for using it at:

Klez Removal Tool

2. After running the Klez removal tool, get the latest updates
for your antivirus software (dated
4/19/02 or later) and, once installed, do a complete
system scan. If the worm deleted crucial system files,
you may need to repair your Windows installation. Seek
professional help if your system continues to produce error
messages in the course of normal operation.

Manual Removal:
-----------------
Get assistance from a knowledgable PC technician to follow these
steps:

1. Disconnect the infected PC from the network (if applicable)
2. Restore the registry to a snapshot earlier than the infection
3. Apply the latest antivirus updates to disable reinfection
4. Run a full virus scan on the system
5. If you have a local network, scan all systems

Best Regards,
Marc Deschenes, VACM Editor
The VACM Project at
Automated PC Solutions

*** Be sure to check out the appendix at the end of this alert
if you are having trouble booting your computer into "Safe Mode".
The process is all spelled out for you there.

Why should you be very
concerned about Spyware?

Learn how to avoid Identity Theft and Windows corruption in this
free VACM Video:
VACM-tested #1 AntiSpyware Software

How did they steal my Identity?

Why do I get so much SPAM ?

Why is your computer
running so slow ?

Today, every PC needs just a few protection softwares. Find out what and why. Visit our Links Page to avoid Indentiry Theft and costly computer repairs.
VACM Links to Protection Tools and Softwares

Keep your PC Safe and
Avoid a costly trip to the shop...
with these VACM approved tools.

You need 3 things to protect your PC(s) automatically. Use these links to go directly to the Download and Purchase pages:

Old Shotgun Shell Boxes
are collector's items and
worth good money!
(yes... just the empty boxes)

get your
ShotShell BlueBook
price guide
now.

To cancel your subscription to VACM, reply to this email with the word UNSUBSCRIBE in the subject.

If you click on the link below, the "unsubscribe" email will be created for you and you can simply hit "Send" in you email program:

Create My Unsubscribe Email

IMPORTANT: please include the email address at which you are currently receiving VACM Alerts in the body of the message.

******** APPENDIX - Handy How-To Tips **********

* How To Boot into Safe Mode

Shut the computer down so that the power is off.

Turn the computer on, wait 1 second and begin pressing the F8 key
on the keyboard, once every second repeatedly. Do this until
the Windows Startup Menu appears. If you get a keyboard
error, press F1 to resume and then continue pressing the
F8 key once every second, or your PC may tell you to press another key for BIOS setup.

Select Safe Mode from the Windows Startup Menu, then press
the Enter key on the keyboard.

Windows will then boot into Safe Mode.
NOTE: This may take longer than a normal boot.

At the end of the boot process a dialog box will appear
informing you that Windows is in Safe Mode. Click OK on this dialog box.

Windows is now in Safe Mode.

If you miss hitting the F8 at the right time, Windows will boot
normally and you will not see the "Safe Mode" message. In this
case, start from the top of these instructions until you get the
boot menu screen where you can choose "Safe Mode". This can be
a little tricky the first time you do it.