# Some Doper who has e-mailed me has a virus and doesn't know it. **URL:** \ **Category:** Miscellaneous and Personal Stuff I Must Share\ **Created:** [June 11, 2003, 12:50am UTC](https://boards.straightdope.com/t/some-doper-who-has-e-mailed-me-has-a-virus-and-doesnt-know-it/181005 "2003-06-11T00:50:33Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![Larry\_Mudd](https://avatars.discourse-cdn.com/v4/letter/l/f14d63/32.png) [@Larry\_Mudd](https://boards.straightdope.com/u/Larry_Mudd)\ **Post date:** [June 11, 2003, 12:50am UTC](https://boards.straightdope.com/t/some-doper-who-has-e-mailed-me-has-a-virus-and-doesnt-know-it/181005/1 "2003-06-11T00:50:33Z")
Okay, folks, I’m getting thirty or forty “returned” klez-propagating e-mails daily, and it’s starting to get me down. _Someone_ who has me in their Outlook address book is infected with the persnickety Klez32 worm, which is industriously sending of hundreds of e-mails with _my_ return address showing as the sender. I deduce that the infected party is a Doper, because some of the “returned” mail is coming from the mailer daemon at [straightdope.com](http://straightdope.com) How can you tell if _you_ the unclean one? A few indications- Have you ever contacted me by email? Do you use Outlook? If the answer is yes, please stop. Consider using this opensource mail client which looks and acts very much luck Outlook, except that it offers an acceptable level of security. Even if you don’t use Outlook, if you have within the last few weeks incautiously opened an attachment, (and are using windows) you can be infected. The subject line of the infected mail _may_ contain one of the following phrases: > [@](#): > > how are you > let’s be friends > darling > so cool a flash,enjoy it > your password > honey > some questions > please try again > welcome to my hometown > The Garden of Eden > introduction on ADSL > meeting notice > questionnaire > congratulations > sos! > japanese girl VS playboy > look,my beautiful girl friend > eager to see you > spice girls’ vocal concert > japanese lass’ sexy pictures Or something entirely different. Received an attachment that didn’t make sense, even though it appeared to be from someone you knew? I’ve deleted hundreds of these “returned” messages so far, but here are some (partial) email addresses that they were originally sent to: > [@](#): > > sampson2149@_.com > [thestrdope@aol.com](mailto:thestrdope@aol.com) (I’m guessing that means the infected one is an old Doper) > lorrainehollond@_.ca > dmartyn@_.com > kasbourin@_.net > smr@_.com > jclang@_.net > _Somebody_@gsk.com (GlaxoSmithKline) > [support@cuteftp.com](mailto:support@cuteftp.com) > [aufeedback@aol.com](mailto:aufeedback@aol.com) If any of those contacts look vaguely familiar to you, heads up. (Bear in mind that about half of those were bounced because the address is no longer good, so it may be an _old_ contact.) Now, this might not be a _huge_ inconvenience, as the email client I use pegs these as “junk” and I don’t _have_ to look at them. However, hundreds of e-mails going out with my name on them is going to translate into a huge increase in spam in my inbox in a few short months. (Any increase is significant, as I’ve managed to keep my inbox spam-free for three the last three years.) Any of the above ringing alarm bells? Please, download and run the [free Klez removal tool](http://securityresponse.symantec.com/avcenter/venc/data/w32.klez.removal.tool.html) from symantec. Hell, even if none of the above seems to apply to you, if you have a few spare minutes, and you use windows, go ahead and run it anyway – the worst thing about Klez is its stealthiness-- you won’t notice anything suspicious if you’re infected, unless you’re the sort who closely monitors all the traffic on your network. Thanks for your time. ---
**Author:** ![jackelope](https://avatars.discourse-cdn.com/v4/letter/j/a6a055/32.png) [@jackelope](https://boards.straightdope.com/u/jackelope)\ **Post date:** [June 11, 2003, 1:12am UTC](https://boards.straightdope.com/t/some-doper-who-has-e-mailed-me-has-a-virus-and-doesnt-know-it/181005/2 "2003-06-11T01:12:55Z")
Yuk. Good luck getting shut of the sticky situation. I get those constantly at work; today, my first day back after a regular, two-day weekend, I had about 100 new e-mails, of which exactly five were NOT spam or klez-droppings. At home I use [Eudora](http://www.eudora.com), which is free and in my opinion far superior to Outlook. Plus no one designs viruses for it. ---
**Author:** ![Aslan\_of\_Narnia](https://avatars.discourse-cdn.com/v4/letter/a/ecd19e/32.png) [@Aslan\_of\_Narnia](https://boards.straightdope.com/u/Aslan_of_Narnia)\ **Post date:** [June 11, 2003, 1:24am UTC](https://boards.straightdope.com/t/some-doper-who-has-e-mailed-me-has-a-virus-and-doesnt-know-it/181005/3 "2003-06-11T01:24:15Z")
What motivates people to create things like the Klez virus? Just to fuck around with people? ---
**Author:** ![Q.E.D](https://avatars.discourse-cdn.com/v4/letter/q/51bf81/32.png) [@Q.E.D](https://boards.straightdope.com/u/Q.E.D)\ **Post date:** [June 11, 2003, 1:36am UTC](https://boards.straightdope.com/t/some-doper-who-has-e-mailed-me-has-a-virus-and-doesnt-know-it/181005/4 "2003-06-11T01:36:19Z")
I’m getting those too. On average about 10 per day. It’s not me, my system is clean. I do regular scans and I’m too smart to get a vir&\*^83kdokd;…//////////////////////////////////////87fjnz76ghZ7ewytZ&76nd$rtgf3w7…}¸0​:diamonds:‘12¨4ÿ52àⁿ721•♦1​:relaxed:1,),·5​:diamonds:5​:diamonds:◘:clubs:1 Beeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeep ---
**Author:** ![Lord\_Jim](https://avatars.discourse-cdn.com/v4/letter/l/ecccb3/32.png) [@Lord\_Jim](https://boards.straightdope.com/u/Lord_Jim)\ **Post date:** [June 11, 2003, 1:37am UTC](https://boards.straightdope.com/t/some-doper-who-has-e-mailed-me-has-a-virus-and-doesnt-know-it/181005/5 "2003-06-11T01:37:53Z")
I have seen where the “Return path” line in the header didn’t match the “From” and the “Reply to” lines and the address in the “return path” was the actual sender. … Take a look, it might help track it down. Also the bottom “Received:” section should have the IP address of the originating mail server which might give a clue about the location of the sender. But, running an up to date virus scan is a good suggestion for anyone that is likely to have you in their address book or has received an email from you. Good luck. Klez is a very deceptive virus. ---
**Author:** ![Flamsterette\_X](https://avatars.discourse-cdn.com/v4/letter/f/41988e/32.png) [@Flamsterette\_X](https://boards.straightdope.com/u/Flamsterette_X)\ **Post date:** [June 11, 2003, 1:45am UTC](https://boards.straightdope.com/t/some-doper-who-has-e-mailed-me-has-a-virus-and-doesnt-know-it/181005/6 "2003-06-11T01:45:29Z")
I used to get a lot of these a few months back… the subject line was usually something like: “I’ve found the secret…” Now I might be getting them again… “re: hey, is this still your email address?” or something similar. But it’s not me this time, **Larry**. 🙂 (though maybe I should email you again… later…) None of those addresses look even vaguely familiar to me. F\_X ---
**Author:** ![rjk](https://avatars.discourse-cdn.com/v4/letter/r/ed655f/32.png) [@rjk](https://boards.straightdope.com/u/rjk)\ **Post date:** [June 11, 2003, 4:11am UTC](https://boards.straightdope.com/t/some-doper-who-has-e-mailed-me-has-a-virus-and-doesnt-know-it/181005/7 "2003-06-11T04:11:03Z")
We had a small worm problem at work a couple of weeks ago. I’ll repeat what I mailed out then: **Don’t open attachments!** At least make sure you know what kind of file it is first, but you’re far better off saving it to disk and letting your virus-checker take a look at it. Both Norton and McAfee come with programs to watch files as they’re saved and loaded. Make sure to set the schedule to keep your virus definitions current. (On a related note, MSWindows is set up wrong by default. Bill, in his wisdom, decided we don’t need to know what kind of file we’re clicking on, so file extensions start out hidden. A file that seems to be called, for example, MyPic.jpg (a picture) could really be MyPic.jpg.exe (a program), which might be the installer for a virus or worm. Be careful!) Sorry if I sound preachy here, but we spend far too much time cleaning up when people don’t take care.