virus? what's up with this NKL.SCR?

[adam warlock]

From: xxxx@Xxxxxxx.com
To: lymree , UNEXPECTED_DATA_AFTER_ADDRESS@.SYNTAX-ERROR
Subject: Re: Honey
Date: Tue, 23 Jul 2002 10:01:30 -0400 (EDT)

Scan your comp, you are infected by a virus.
NKL.SCR was included within the infected email.

En réponse à lymree :
HTMLHEADHEADBODY
iframe src=cidOf457v3k3 height=0 width=0>
/iframe>
FONT>

additional information would be appreciated

[KDogRex]

Check on www.symantec.com for infor regarding the particular file. They have almost everything. (God bless Norton 2002 and Live Update)

p.s. that file refers to s screensaver of some kind.

[ 07-24-2002, 03:15 PM: Message edited by: KDogRex ]

[dizzy]

hmm osunds like it to me hmm

[adam warlock]

yeah I have yet to upload my anti-virus program... *looks over to her piles and piles of programs disks waiting their turn*

I'm still restoring my comp [img]tongue.gif[/img]

I've checked with google.com search and no go

[slackerboy]

ok, i've done quite a bit of searching using several variations and looking in several places.
i have found no reference to this at all
i am inclined not to believe it.
thats not to say i'm 100% sure,
but i doubt its real

[slackerboy]

http://www.trendmicro.com/free_tools/
do a free online AV scan here

[ 07-24-2002, 07:23 PM: Message edited by: slackerboy ]

[skywalker]

I can't find a reference to this "virus" anywhere. I'm not so sure it's a virus, either!

I did find out that NKL is some sort of German Lottery, though!

Mark

[adam warlock]

Ok it turns out that someone is using my email addy to send out crap
with the subject text with 'Re: Honey'

if you see any from lymree@hotmail.com (my site's email now), ignore it. I don't send out emails with that hotmail addy.

thanks slackerboy...

I searched the scr and it was just a worm 'goner' virus

[adam warlock]

ooook I did some scanning... and yep, it's a small worm virus that only hangs around on emails. Like I said, I don't have it.. but I've talked to other hotmail users and they got it... 25 of them

me thinks it is either a new one or unknown that the anti-virus programs do not detect it.

pass this info around folks:
If you see any emails with the subject title that says either 'Honey' or 'Re: Honey', please send/report it to your anti-virus program service. Do not even click on that email
I've yet to confirm about this but one never can be sure unless you get the anti-virus service to check it out

[Leonis]

It's the one that sends out emails with the "from" as someone in your address book, not your own address. Therefore-someone with lymree@hotmail.com in their addresses book has the virus...
I think Ziroc discussed this earlier?

Can't search for it...(where's that function gone?)
but this explains it a bit more.

Edit: I'm assuming that it's a variation on the Klez virus, the subject and text you get is the random data...?

[ 07-25-2002, 12:08 AM: Message edited by: Leonis ]