# Possible email virus - 'A very nice game' **URL:** \ **Category:** Factual Questions\ **Created:** [May 1, 2002, 3:54pm UTC](https://boards.straightdope.com/t/possible-email-virus-a-very-nice-game/106666 "2002-05-01T15:54:39Z")\ **Posts on this page:** 17\ **Page:** 1
**Author:** ![Athena](https://avatars.discourse-cdn.com/v4/letter/a/35a633/32.png) [@Athena](https://boards.straightdope.com/u/Athena)\ **Post date:** [May 1, 2002, 3:54pm UTC](https://boards.straightdope.com/t/possible-email-virus-a-very-nice-game/106666/1 "2002-05-01T15:54:39Z")
I’ve been receiving strange emails from people lately. I suspect they’re some form of an email virus. They come from addresses I recognize, and have text similiar to : Hello,This is a nice game This game is my first work. You’re the first player. I hope you would like it. I can’t find any info on the web in general or on symantic’s Norton Anti-Virus page. I’ve gotten the email with the identical text from several people - all relatives of mine, so I’m guessing one person is infected and is infecting other people as well. I have the latest and greatest NAV files, and it’s not detecting anything. Any ideas? ---
**Author:** ![scotth](https://avatars.discourse-cdn.com/v4/letter/s/b9e5f3/32.png) [@scotth](https://boards.straightdope.com/u/scotth)\ **Post date:** [May 1, 2002, 4:43pm UTC](https://boards.straightdope.com/t/possible-email-virus-a-very-nice-game/106666/2 "2002-05-01T16:43:55Z")
I have seen that very email. I opened the file in a hex editor to take a quick peak. It is almost certainly a trojan horse. I trashed it. I recommend you do the same. As for your relatives, hopefully someone will come along shortly with clean up instructions. ---
**Author:** ![Hodge](https://avatars.discourse-cdn.com/v4/letter/h/5f9b8f/32.png) [@Hodge](https://boards.straightdope.com/u/Hodge)\ **Post date:** [May 1, 2002, 4:56pm UTC](https://boards.straightdope.com/t/possible-email-virus-a-very-nice-game/106666/3 "2002-05-01T16:56:16Z")
Man, my email boxes have been _flooded_ with these damn things recently. I’ve received it at least a dozen times in the past 2 days. AVG Antivirus detects it as some sort of worm but I can’t remember the exact name. If your Norton AV files aren’t detecting it, then you might consider downloading [AVG](http://www.grisoft.com) (it’s freeware) just cover all your bases. ---
**Author:** ![Hodge](https://avatars.discourse-cdn.com/v4/letter/h/5f9b8f/32.png) [@Hodge](https://boards.straightdope.com/u/Hodge)\ **Post date:** [May 1, 2002, 5:05pm UTC](https://boards.straightdope.com/t/possible-email-virus-a-very-nice-game/106666/4 "2002-05-01T17:05:40Z")
I just got _yet another_ one. It’s called I-Worm/Klez.H ---
**Author:** ![slortar](https://avatars.discourse-cdn.com/v4/letter/s/6bbea6/32.png) [@slortar](https://boards.straightdope.com/u/slortar)\ **Post date:** [May 1, 2002, 5:16pm UTC](https://boards.straightdope.com/t/possible-email-virus-a-very-nice-game/106666/5 "2002-05-01T17:16:34Z")
It’s definitely Klez. Wired recently had an article about it. You can read it [here.](http://www.wired.com/news/technology/0,1282,52174,00.html) ---
**Author:** ![RealityChuck](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/realitychuck/32/195_2.png) [@RealityChuck](https://boards.straightdope.com/u/RealityChuck)\ **Post date:** [May 1, 2002, 6:26pm UTC](https://boards.straightdope.com/t/possible-email-virus-a-very-nice-game/106666/6 "2002-05-01T18:26:01Z")
Klez is all over these days. It takes a lot of forms and is annoyingly persistant (and don’t bother telling the person who “sent” you the e-mail – that address is randomly chosen and has nothing to do with the sender). ---
**Author:** ![Jman](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/jman/32/4416_2.png) [@Jman](https://boards.straightdope.com/u/Jman)\ **Post date:** [May 1, 2002, 7:08pm UTC](https://boards.straightdope.com/t/possible-email-virus-a-very-nice-game/106666/7 "2002-05-01T19:08:54Z")
I’ve received Klez about 40 times in the past 2 months. It’s really annoying. Also annoying about Klez is the FROM: address is not the person who is infected, but a random name from the addressbook of the infected person. Consequently, I’ve received 2 angry e-mails claiming I sent them the virus, when I didn’t. NAV quarantines Klez before it even finishes downloading…and I don’t even have an addressbook. ---
**Author:** ![whitetho](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/whitetho/32/1059_2.png) [@whitetho](https://boards.straightdope.com/u/whitetho)\ **Post date:** [May 1, 2002, 10:36pm UTC](https://boards.straightdope.com/t/possible-email-virus-a-very-nice-game/106666/8 "2002-05-01T22:36:18Z")
I was just sent a copy of the worm which claims its attachment is actually for “protecting” against the worm. The body of the text reads: > [@](#): > > From: Editor Re: Worm Klez.E immunity > > Klez.E is the most common world-wide spreading worm.It’s very dangerous by corrupting your files. > Because of its very smart stealth and anti-anti-virus technic,most common AV software can’t detect or clean it. > We developed this free immunity tool to defeat the malicious virus. > You only need to run this tool once,and then Klez will never come into your PC. > NOTE: Because this tool acts as a fake Klez to fool the real worm,some AV monitor maybe cry when you run it. > If so,Ignore the warning,and select ‘continue’. > If you have any question,please mail to me \<[mailto:editor@LosAngelesAlm](mailto:editor@LosAngelesAlm)…\>. The attachment is named backgound(1).scr, and is 88k in size, which is the same size as the other infected attachments. So, obviously, this is a copy of the worm which would infect my computer if I ran it, and not a real disinfectant. Any my AV monitor would “cry” because it was the real thing. ---
**Author:** ![BoBettie](https://avatars.discourse-cdn.com/v4/letter/b/4af34b/32.png) [@BoBettie](https://boards.straightdope.com/u/BoBettie)\ **Post date:** [May 2, 2002, 12:33am UTC](https://boards.straightdope.com/t/possible-email-virus-a-very-nice-game/106666/9 "2002-05-02T00:33:55Z")
Weird- I got that and there was nothing attached. How bizzare! I was thinking “This is the dumbest virus writer on Earth” ---
**Author:** ![butter\_pie](https://avatars.discourse-cdn.com/v4/letter/b/aca169/32.png) [@butter\_pie](https://boards.straightdope.com/u/butter_pie)\ **Post date:** [May 2, 2002, 3:33am UTC](https://boards.straightdope.com/t/possible-email-virus-a-very-nice-game/106666/10 "2002-05-02T03:33:53Z")
I have gotten many of those recently, but they all had “darling” and “sweetheart” and were written up like loveletters. Many have been from the same address. I replied to one and that particular address stopped sending them. I’m still not sure whether they were sent by the virus on an innocent person’s computer, or someone was forwarding them to me intentionally. I don’t use Microsoft Outlook though so it isn’t really an issue (other than being annoying). ---
**Author:** ![Hodge](https://avatars.discourse-cdn.com/v4/letter/h/5f9b8f/32.png) [@Hodge](https://boards.straightdope.com/u/Hodge)\ **Post date:** [May 9, 2002, 12:48pm UTC](https://boards.straightdope.com/t/possible-email-virus-a-very-nice-game/106666/11 "2002-05-09T12:48:30Z")
Bumping this because I just received another version, with the accompanying text: > [@](#): > > Klez.E is the most common world-wide spreading worm.It’s very dangerous by corrupting your files. > Because of its very smart stealth and anti-anti-virus technic,most common AV software can’t detect or clean it. > We developed this free immunity tool to defeat the malicious virus. > You only need to run this tool once,and then Klez will never come into your PC. > NOTE: Because this tool acts as a fake Klez to fool the real worm,some AV monitor maybe cry when you run it. > If so,Ignore the warning,and select ‘continue’. > If you have any question,please mail to me. Of course, my fellow dopers are too smart to fall for this noxious bullshit, but perhaps we can help out our more naive friends and family and warn them away. ---
**Author:** ![Padeye](https://avatars.discourse-cdn.com/v4/letter/p/a9a28c/32.png) [@Padeye](https://boards.straightdope.com/u/Padeye)\ **Post date:** [May 9, 2002, 12:52pm UTC](https://boards.straightdope.com/t/possible-email-virus-a-very-nice-game/106666/12 "2002-05-09T12:52:29Z")
The klez virus does email spoofing so it probably isn’t from the “from” address. If you open up the header look at the return path, that’s probably who it came from. Also don’t be lulled if you don’t see an attachment, it keeps them hidden. I use yahoo mail which seems to keep it from spreading automatically. I have to intentionally click “download attachments” to see that there are any. From there I can scan the various files to identify the virus before downloading. ---
**Author:** ![malden](https://avatars.discourse-cdn.com/v4/letter/m/7bcc69/32.png) [@malden](https://boards.straightdope.com/u/malden)\ **Post date:** [May 9, 2002, 2:41pm UTC](https://boards.straightdope.com/t/possible-email-virus-a-very-nice-game/106666/13 "2002-05-09T14:41:03Z")
I got the “very nice game” message the other day and the attachment was an HTML document (CAWLIZWP.HTM). I opened it in a text editor. It contained some references to the address [dgl.microsoft.com](http://dgl.microsoft.com). The references were all to little .GIF images of animals. Is the virus somehow hidden “between the lines?” I looked around a little at [dgl.microsoft.com](http://dgl.microsoft.com) and can’t make much sense of it. I am using a Mac (OSX v10.1.2). Is the klez virus Windows-only?? I also received an email from a stranger with a .JPG of a bright green VW New Beetle. I suppose this is also a virus… malden ---
**Author:** ![dwc1970](https://avatars.discourse-cdn.com/v4/letter/d/a183cd/32.png) [@dwc1970](https://boards.straightdope.com/u/dwc1970)\ **Post date:** [May 9, 2002, 3:59pm UTC](https://boards.straightdope.com/t/possible-email-virus-a-very-nice-game/106666/14 "2002-05-09T15:59:00Z")
I have gotten emails like this and others, all with different subject lines and sender names, thereby making it _impossible_ to filter them out. :mad: I use Outlook 2000 with the preview pane option on. The window is always blank and there are no attachments that I can see. Even though I never fully open these emails the preview pane is still having to process something in order to view it. NAV doesn’t find anything in them, and last I scanned my hard drive for viruses nothing was found. I’d like to use the preview pane, and I don’t see that these emails are doing any damage to my system, but if someone recommends that I should turn off the preview pane then I will heed his/her advice. ---
**Author:** ![AHunter3](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/ahunter3/32/368_2.png) [@AHunter3](https://boards.straightdope.com/u/AHunter3)\ **Post date:** [May 9, 2002, 5:19pm UTC](https://boards.straightdope.com/t/possible-email-virus-a-very-nice-game/106666/15 "2002-05-09T17:19:26Z")
**malden** > [@](#): > > I also received an email from a stranger with a .JPG of a bright green VW New Beetle. I suppose this is also a virus… No, that’s a bug. ---
**Author:** ![ElwoodCuse](https://avatars.discourse-cdn.com/v4/letter/e/edb3f5/32.png) [@ElwoodCuse](https://boards.straightdope.com/u/ElwoodCuse)\ **Post date:** [May 9, 2002, 10:09pm UTC](https://boards.straightdope.com/t/possible-email-virus-a-very-nice-game/106666/16 "2002-05-09T22:09:34Z")
I got that “game” email. I read it, but I didn’t download any attachements and I use my school’s webmail (with IE) and not Outlook Express. Am I safe? ---
**Author:** ![Motog](https://avatars.discourse-cdn.com/v4/letter/m/85e7bf/32.png) [@Motog](https://boards.straightdope.com/u/Motog)\ **Post date:** [May 10, 2002, 2:34am UTC](https://boards.straightdope.com/t/possible-email-virus-a-very-nice-game/106666/17 "2002-05-10T02:34:28Z")
Klez is a really annoying worm. Apart from the features mentioned above, it can also infect your computer if you use the preview function to view the infected email **best to turn the preview function off and just delete these emails as soon as they turn up** Another particularly annoying feature is that it attacks and disables most antivirus software, so you might not realise you’ve got it until your software starts acting up. It uses a range of about 100 subject lines (like the one about the game or the ones beginning “Darling…” My wife got this on our computer the other day and didn’t realise that she had it for a few days. Took me ages to get it off. Had to get a new Klez-specific antivirus script, run the computer in safe mode and run it a couple of times to clean it all off. Best approach is turn off preview and just delete anything suspicious immediately.