[Towertalk] FW: Virus removal from Norton AntiVirus SupportNow News Bulletin: Apr. 26, 2002

Sun, 28 Apr 2002 13:10:38 -0500

Please Read the following information Norton antivirus has a fix for the
virus for free please read Below.
N9IWW
Kevin Adam
1239 W. Till Rd.
Fort Wayne In. 46825-2145

Phone & Fax 1-260-4907312

-----Original Message-----
From: NAV-Techinfo [mailto:es@symantec.com] 
Sent: Friday, April 26, 2002 8:17 AM
To: NAV-TECHINFO-L@lserver.symantec.com
Subject: Norton AntiVirus SupportNow News Bulletin: Apr. 26, 2002

April 26, 2002
_____________________________

In this issue:

1. W32.Klez.gen@mm
2. Removal utility
3. Feedback
4. Subscribing and unsubscribing
5. Disclaimer

_____________________________

NOTE: This is an outgoing email address. Do not reply to this email
message. If you require assistance with installing, configuring, or
troubleshooting a Symantec product, or if you have a question for
Customer Service, then visit the Symantec Service & Support Web site
at the following Internet address:

http://www.symantec.com/techsupp/

Select your product and version, and then click Go.

To view this and prior News Bulletins in HTML format, visit the
following Internet address:

http://www.symantec.com/techsupp/vURL.cgi/navarc

_____________________________

1. W32.Klez.gen@mm

W32.Klez.gen@mm is a mass-mailing worm that searches the Windows
address book for email addresses and sends messages to all recipients
that it finds. The worm uses its own SMTP engine to send the messages.

The subject and attachment name of incoming email is chosen randomly.
The attachment will have one of the following extensions: .bat, .exe,
.pif or .scr.

The worm exploits a vulnerability in Microsoft Outlook and Outlook
Express in an attempt to execute itself when you open or even preview
the message.

W32.Klez.gen@mm attempts to copy itself to all network shared drives
that it finds.

Depending on the variant of the worm, the worm will infect the system
with one of the following viruses:

W32.Klez.gen@mm is a generic detection that detects variants of
W32.Klez. Computers that are infected with W32.Klez.gen@mm are most
likely infected with either W32.Klez.E@mm or W32.Klez.H@mm. Please
refer to the following write-ups for more information.

W32.Klez.E@mm

http://www.symantec.com/techsupp/vURL.cgi/nav115

W32.Klez.H@mm

http://www.symantec.com/techsupp/vURL.cgi/nav116

_____________________________

2. Removal utility

Symantec has provided a utility to remove infections of
W32.Klez.E@mm, W32.Klez.H@mm, W32.ElKern.3587, and W32.ElKern.4926.
If your computer is detected as infected with W32.Klez.gen@mm,
download and run the utility. In most case, to utility can remove the
infection. To download the W32.Klez removal utility, point your Web
browser to:

http://www.symantec.com/techsupp/vURL.cgi/nav117

This is the easiest way to remove these threats and should be tried
first.

Virus definitions dated April 17, 2002, or later will detect this
worm.

For additional information, point your Web browser to:

http://www.symantec.com/techsupp/vURL.cgi/nav118

_____________________________

3. Feedback

Do you have feedback that can help us provide better products or
services? If so, then we want to hear from you. Visit the Symantec
suggestion box at the following Internet address, and let us know how
we can improve:

http://www.symantec.com/feedback/
_______________________________

4. Subscribing or unsubscribing

If you want to subscribe to other Symantec newsletters, then follow
the instructions at the following Internet address:

http://www.symantec.com/techsupp/bulletin/index.html

If you no longer want to receive this newsletter, then follow these
steps:

1. Create a new email message addressed to:

LISTSERV@LSERVER.SYMANTEC.COM

2. In the Subject line, type the following:

UNSUBSCRIBE

3. In the body of the message, type the following:

SIGNOFF NAV-TECHINFO-L

4. Send the message.

If you want to unsubscribe from other Symantec newsletters, then
follow the instructions at the following Internet address:

http://www.symantec.com/techsupp/bulletin/index.html

_____________________________

5. Disclaimer

THIS DOCUMENT IS PROVIDED FOR INFORMATIONAL PURPOSES ONLY.

This message contains Symantec Corporation's current view of the
topics discussed as of the date of this document. The information
contained in this message is provided "as is" without warranty of any
kind, either expressed or implied, including but not limited to the
implied warranties of merchantability, fitness for a particular
purpose, and freedom from infringement. The user assumes the entire
risk as to the accuracy and the use of this document. This document
may not be distributed for profit.

Symantec and the Symantec logo are U.S. registered trademarks of
Symantec Corporation. Other brands and products are trademarks of
their respective holder(s).