Another virus alert!! (hope this isn't a duplicate post)

[Mr. Goodbytes]

My sister down at Purdue was concerned about these emails she kept getting that had in the subject: "Fwd: Have a excite Lady Day." She didn't open the attachment, thank God, but she was repeatedly receiving the messages, and they came from other students at Purdue, which led her to believe that they might not be virus plagued emails. Well they are. They contain the W32/Klez.e@MM Virus. I don't know much about it, but hotmail indicated that to be the virus in the attachement "href.scr" Watch out and don't get nailed by this bug. If anyone knows more about it or is willing to look it up, which I am not (yes, i'm too lazy), please add your insight.

[EndobioticChaos]

Taken from Symantec's website:

Quote:

Due to an increased rate of submissions, Symantec Security Response is upgrading the threat level for W32.Klez.E@mm from level 2 to level 3 as of March 6, 2002.

W32.Klez.E@mm is similar to W32.Klez.A@mm. It is a mass-mailing email worm that also attempts to copy itself to network shares. The worm uses random subject lines, message bodies, and attachment file names.

The worm exploits a vulnerability in Microsoft Outlook and Outlook Express in an attempt to execute itself when you open or even preview the message in which it is contained. Information and a patch for the vulnerability are available at http://www.microsoft.com/technet/sec.../MS01-020.asp.

The worm overwrites files and creates hidden copies of the originals. In addition, the worm drops the virus W32.Elkern.3587, which is similar to W32.ElKern.3326.

The worm attempts to disable some common antivirus products and has a payload which fills files with all zeroes.

Click here for more info: http://securityresponse.symantec.com...klez.e@mm.html

[Sohgin]

Ouch, sounds like a nasty one.