[prev in list] [next in list] [prev in thread] [next in thread] 

List:       dshield
Subject:    Re: [Dshield] W32.Klez.E fake removal tool email
From:       Mark Tombaugh <mtombaugh () alliedcc ! com>
Date:       2003-08-28 19:12:36
[Download RAW message or body]

On Thursday 28 August 2003 08:37 am, Bruyere, Michel wrote:
> Hi,
>  I got flooded by an email that has a install.exe file attached to it. This
> email claims that it's the removal tool for the Klez.e Virus. Am I the only
> one who got many of them?

A couple of the Klez variants masquerade as Klez.e removal tools. 
http://vil.nai.com/vil/content/v_99455.htm

or:
http://vil.nai.com/vil/content/v_99455.htm
---
Subject: Worm Klez.E Immunity 
Klez.E is the most common world-wide spreading worm. It's very dangerous by 
corrupting your files. Because of its very smart stealth and anti-anti-virus 
technic,most common AV software can't detect or clean it.We developed this 
free immunity tool to defeat the malicious virus. You only need to run this 
tool once,and then Klez will never come into your PC.

NOTE: Because this tool acts as a fake Klez to fool the real worm,some AV 
monitor maybe cry when you run it. If so,Ignore the warning,and select 
'continue'. If you have any question,please mail to me. 
---

Never trust a random exe (or any script for that matter) in your inbox.

-- 
Mark Tombaugh <mtombaugh@alliedcc.com>
Allied Computer Corporation <http://www.alliedcc.com>
USiHOST, iNC. <http://www.usihost.com>

PGP = 634A71E6 Mark Tombaugh (Allied Computer Corporation)
   Key fingerprint = 9686 AEB5 2FB1 E35B 4FBB  66EB 58EA 1AA9 634A 71E6 



_______________________________________________
list mailing list
list@dshield.org
To change your subscription options (or unsubscribe), see: http://www.dshield.org/mailman/listinfo/list

[prev in list] [next in list] [prev in thread] [next in thread]