Virus Alert: Klez H Virus

Penn State faculty, staff, and students should be on the lookout for the Klez.H e-mail virus, a modified version of the Klez.E virus, which attempts to trick recipients by sometimes promoting itself as a provider of antivirus software. Sybari Software, Inc., a premier developer of antivirus and security software, reported last week that the mass e-mail worm virus known as Klez.H is spreading via the Internet. The worm is also known as Klez.K, Klez.G and Klez.I and arrives in an e-mail message with one of 120 possible subject lines, including "let's be friends," "meeting notice," "some questions," "honey," and "a X game" and "a X patch," where "X" can be one of 16 different words, such as "new," "WinXP," and the name of any of the six major antivirus companies. The virus is capable of infecting files on shared network drives and copies itself to the Windows registry and modifies the registry, so that the virus will execute each time the machine boots up. Klez.H also attempts to disable any antivirus software residing on the infected machine. In an effort to trick the recipient, the body of an infected e-mail may contain the text "We developed this free immunity tool to defeat the malicious virus. You only need to run this tool once, and then Klez will never come into your PC." For additional information on the Klez.H virus please see: http://securityresponse.symantec.com/avcenter/venc/data/w32.klez.h@mm.html

Note: The University recently purchased a site license for Symantec's Norton Antivirus software, which makes the product available to faculty, staff, and students at no cost. Penn State community members interested in acquiring this software should go to the Microcomputer Order Center Web site at http://moc.cac.psu.edu/products/symantec.html for additional information. If you believe that your computer has been infected, be sure to contact the Consulting and Support Services Help Desk at (814) 863-1035 or (814) 863-2494 for assistance. If you receive an infected e-mail, please forward it (with full headers showing so it can be traced) to security@psu.edu.