Klez sneaks by POP3 Scanner

So, I get this "Undeliverable Mail" from "Postmaster at AOL."

No alarms go off, but it has two harmless attachments, and a third, a small file named "PAS" no extension. I save it to disk, check with NOD32, to find it ID'd as Win32/JKlez.

Now, I assume it got by the POP3 scanner since it had no extension. Is it launchable without an extension? (I didn't try it, it's gone now.)

J Smith

 

Klez usually travels as a self-executing script in the body of an email. It sounds like your attachment was the Klez script in non-executable form. NOD32 would ignore it unless you scanned tor files without extensions, as it was harmless in that state.

 

Thankee, sir. I suspected as much, but hadn't encountered this particular wrinkle to the pesky Klez.

J Smith