# Did I just get sent a virus? **URL:** \ **Category:** Miscellaneous and Personal Stuff I Must Share\ **Created:** [July 5, 2002, 1:59am UTC](https://boards.straightdope.com/t/did-i-just-get-sent-a-virus/117436 "2002-07-05T01:59:39Z")\ **Posts on this page:** 8\ **Page:** 1
**Author:** ![Grelby](https://avatars.discourse-cdn.com/v4/letter/g/a5b964/32.png) [@Grelby](https://boards.straightdope.com/u/Grelby)\ **Post date:** [July 5, 2002, 1:59am UTC](https://boards.straightdope.com/t/did-i-just-get-sent-a-virus/117436/1 "2002-07-05T01:59:39Z")
I just recieved an email from a friend of mine that looks suspicious. The entire text of the message is, "W32.Klez.E is a dangerous virus that spread through email. F-Secure give you the W32.Klez.E removal tools. For more information, please visit [http://www.f-secure.com](http://www.f-secure.com)" The above quote is VERBATIM, including grammar mistakes. Attached to this is an executable file named Setup.exe. I have talked to my friend and confirmed that she did NOT send this email. Has anyone else recieved something like this? Could we be looking at another attempted virus attack? ---
**Author:** ![AHunter3](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/ahunter3/32/368_2.png) [@AHunter3](https://boards.straightdope.com/u/AHunter3)\ **Post date:** [July 5, 2002, 2:26am UTC](https://boards.straightdope.com/t/did-i-just-get-sent-a-virus/117436/2 "2002-07-05T02:26:32Z")
I think you’re right–I remember hearing about a Klez variant that was being sent around as if it were its own removal tool At any rate, if you want a Klex removal tool, I’d suggest going [here](http://securityresponse.symantec.com/avcenter/venc/data/w32.klez.removal.tool.html) for it instead. ---
**Author:** ![welby1](https://avatars.discourse-cdn.com/v4/letter/w/838e76/32.png) [@welby1](https://boards.straightdope.com/u/welby1)\ **Post date:** [July 5, 2002, 2:32am UTC](https://boards.straightdope.com/t/did-i-just-get-sent-a-virus/117436/3 "2002-07-05T02:32:17Z")
You’re friend is probably infected, you’re probably not. AHunter’s link will get you clean if you need to be. ---
**Author:** ![Hanna](https://avatars.discourse-cdn.com/v4/letter/h/b3f665/32.png) [@Hanna](https://boards.straightdope.com/u/Hanna)\ **Post date:** [July 5, 2002, 2:55am UTC](https://boards.straightdope.com/t/did-i-just-get-sent-a-virus/117436/4 "2002-07-05T02:55:06Z")
Actually, it may not be your friend that is infected. The Klez worm spoofs email addresses and makes it look like its coming from someone you know, when it really is coming from a totally different email address - possibly someone who has your fried’s email in their addy book. ---
**Author:** ![Grelby](https://avatars.discourse-cdn.com/v4/letter/g/a5b964/32.png) [@Grelby](https://boards.straightdope.com/u/Grelby)\ **Post date:** [July 5, 2002, 3:40am UTC](https://boards.straightdope.com/t/did-i-just-get-sent-a-virus/117436/5 "2002-07-05T03:40:31Z")
Ok, good. I deleted the email after posting the OP and did not open the file. I wish I could have checked full headers first, though - since apparently it may not be from her, after all. Well, nothing I can do now. I believe that I’m safe, though. ---
**Author:** ![handy](https://avatars.discourse-cdn.com/v4/letter/h/b5a626/32.png) [@handy](https://boards.straightdope.com/u/handy)\ **Post date:** [July 5, 2002, 3:54pm UTC](https://boards.straightdope.com/t/did-i-just-get-sent-a-virus/117436/6 "2002-07-05T15:54:57Z")
Even if you looked at the headers you wouldn’t be able to tell much because anyone stupid enough to email something like that would have been clever enough to change their heading to hide. I get about 8 per day. But I never open them. ---
**Author:** ![dantheman](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/dantheman/32/9421_2.png) [@dantheman](https://boards.straightdope.com/u/dantheman)\ **Post date:** [July 5, 2002, 4:46pm UTC](https://boards.straightdope.com/t/did-i-just-get-sent-a-virus/117436/7 "2002-07-05T16:46:09Z")
I get tons of those alleged Klez ‘fixes’ or ‘warnings’ - I delete them all, because there’s always some executable attached, and I didn’t ask for one. 🙂 ---
**Author:** ![Eats\_Crayons](https://avatars.discourse-cdn.com/v4/letter/e/278dde/32.png) [@Eats\_Crayons](https://boards.straightdope.com/u/Eats_Crayons)\ **Post date:** [July 5, 2002, 4:56pm UTC](https://boards.straightdope.com/t/did-i-just-get-sent-a-virus/117436/8 "2002-07-05T16:56:40Z")
> [@](#): > > \*Originally posted by handy \* > \*\*Even if you looked at the headers you wouldn’t be able to tell much because anyone stupid > enough to email something like that would have been clever enough to change their heading to hide. \*\* Actually, the Klez virus spoof the senders address, but doesn’t seem to affect the headers (at least not the version we keep getting). We have one customer who keep sending us the Klez virus (unknowingly). We know who it is because depsite the fact that the phony sender’s address keeps changing, the IP address in the headers is always the same (our customers.) We’re not 100% sure, but we’re monitoring it. So far it does appear that the IP address is consistently hers no matter what the spoofed sender address is. Interesting, but in the grand scheme of things it’s no big deal.