[Qcwa] Norton may not catch the new ones...

Robert Harvey [email protected]
Tue, 9 Jul 2002 20:29:46 +0200


Frank:  

I, too, sympathize.  If it's any consolation, a lot of people have
gotten burned by Klez.  Even worse, it will send out e-mails with to and
from addresses randomly chosen from your address book, so the e-mail you
got with the original virus may not have come from the person you
thought it was from.  You'd have to look at the message header detail to
really determine the origin.  

There have been some pretty funny stories about just what happens when
Klez does that, including one where a man and his parents, who had been
feuding for some time, were brought back into contact when the son
(Klez, actually) broke the ice by sending an e-mail to his parents.
Probably urban legend, but cute.

But your virus software may not always catch everything; especially if
you update infrequently.  Even worse, if things are not set up just
right, the code in the e-mail can run the file embedded inside before
your scanning software gets a hook into it.  That's why I recommend
using the Zonealarm free software firewall (www.zonelabs.com).  ZA by
default will rename attachments with some other extension, i.e., .Zla,
which will prevent them from being executed when the e-mailed script
demands it.  If it turns out to be harmless, you can look at zonealarms
message log and change the extension back to what it was and run the
file.

It's free, and can save you some pain if you get something you don't
have the update for.  It also acts as a firewall and prevents other
types of malicious hacks as well.  Give it a try, if you don't like it
uninstall, but you get used to having the added protection before Norton
or Mcafee takes a look at the file.

73, Bob Harvey, K2PI / ON9CPI