On the 29th I received an email from a certain 'pbamoderator@pba.com' and the subject was titled 'Look,my beautiful girl friend'

When I clicked on the message I was prompted to save or open the file. I opened it and when my browser opened it showed a Windows 98 icon. That was all. I even saved the message to my site. It doesn't tell you much but the fact that it's an .eml file.

pba.com is a golf site and I received this message from an email address I only make known to THIS site. Am I being spied on, and what should I do?

when i went to the site that you listed i clicked the letter and norton antivirus 2002 pops up and tells me this... appearently you have a copy of the klez virus.

[This message has been edited by Zok (edited 06-02-2002).]

Yeah, Klez is my guess too, without even looking.. I get about 20 of those a week at the moment.. and the thing is the email it appears to be from almost always isn't the one it was sent from..

well, technically, you dont need an email address to send email. You just need access to an smtp server.

Wintermute is right. That email is probably forged.

Yeah I got the exact same thing. It defenetly is klez.

Klez's designers were taking advantage of the servers that are set up to autocatch and detect viruses, which usually helpfully email the person they received the virus from to tell them they have one.. with klez though, the address it appears from usually *isn't* the infected one, more likely just one pulled from an address book or webpage somewhere.. so the helpful servers end up exacerbating the problem..

I even got a klez the other day supposedly from the other email account on this machine.. but when I scanned just to check, I didn't have the virus.. (neither of us are dumb enough to click on an unknown attatchment...)

quote:

---

Originally posted by Lokil:
it showed a Windows 98 icon. That was all.
...
what should I do?

---

never save a file you don't know. If it's a pic, it should be a pic in your menu, right?!
And you should disable MIME!

Where exactly is the panel to diable mime? I used to know...its around here somewhere....

copy this:

code:

---

REGEDIT4

[HKEY_CLASSES_ROOT\MIME\Database\Content Type\audio/mpeg]
"CLSID.BAK"="{22D6F312-B0F6-11D0-94AB-0080C74C7E95}"
"CLSID"="Deactivated"

[HKEY_CLASSES_ROOT\MIME\Database\Content Type\audio/basic]
"CLSID.BAK"="{22D6F312-B0F6-11D0-94AB-0080C74C7E95}"
"CLSID"="Deactivated"

[HKEY_CLASSES_ROOT\MIME\Database\Content Type\audio/mid]
"CLSID.BAK"="{22D6F312-B0F6-11D0-94AB-0080C74C7E95}"
"CLSID"="Deactivated"

[HKEY_CLASSES_ROOT\MIME\Database\Content Type\audio/midi]
"CLSID.BAK"="{22D6F312-B0F6-11D0-94AB-0080C74C7E95}"
"CLSID"="Deactivated"

[HKEY_CLASSES_ROOT\MIME\Database\Content Type\audio/x-midi]
"CLSID.BAK"="{22D6F312-B0F6-11D0-94AB-0080C74C7E95}"
"CLSID"="Deactivated"

[HKEY_CLASSES_ROOT\MIME\Database\Content Type\audio/x-aiff]
"CLSID.BAK"="{22D6F312-B0F6-11D0-94AB-0080C74C7E95}"
"CLSID"="Deactivated"

[HKEY_CLASSES_ROOT\MIME\Database\Content Type\audio/aiff]
"CLSID.BAK"="{22D6F312-B0F6-11D0-94AB-0080C74C7E95}"
"CLSID"="Deactivated"

[HKEY_CLASSES_ROOT\MIME\Database\Content Type\audio/wav]
"CLSID.BAK"="{22D6F312-B0F6-11D0-94AB-0080C74C7E95}"
"CLSID"="Deactivated"

[HKEY_CLASSES_ROOT\MIME\Database\Content Type\video/avi]
"CLSID.BAK"="{05589fa1-c356-11ce-bf01-00aa0055595a}"
"CLSID"="Deactivated"

[HKEY_CLASSES_ROOT\MIME\Database\Content Type\video/x-ivf]
"CLSID.BAK"="{05589FA1-C356-11CE-BF01-00AA0055595A}"
"CLSID"="Deactivated"

[HKEY_CLASSES_ROOT\MIME\Database\Content Type\video/mpeg]
"CLSID.BAK"="{22D6F312-B0F6-11D0-94AB-0080C74C7E95}"
"CLSID"="Deactivated"

[HKEY_CLASSES_ROOT\MIME\Database\Content Type\video/quicktime]
"CLSID.BAK"="{22D6F312-B0F6-11D0-94AB-0080C74C7E95}"
"CLSID"="Deactivated"

[HKEY_CLASSES_ROOT\MIME\Database\Content Type\video/msvideo]
"CLSID.BAK"="{22D6F312-B0F6-11D0-94AB-0080C74C7E95}"
"CLSID"="Deactivated"

[HKEY_CLASSES_ROOT\MIME\Database\Content Type\video/x-la-asf]
"CLSID.BAK"="{22D6F312-B0F6-11D0-94AB-0080C74C7E95}"
"CLSID"="Deactivated"

[HKEY_CLASSES_ROOT\MIME\Database\Content Type\video/x-ms-asf]
"CLSID.BAK"="{22D6F312-B0F6-11D0-94AB-0080C74C7E95}"
"CLSID"="Deactivated"

[HKEY_CLASSES_ROOT\MIME\Database\Content Type\video/x-ms-asf-plugin]
"CLSID.BAK"="{22D6F312-B0F6-11D0-94AB-0080C74C7E95}"
"CLSID"="Deactivated"

[HKEY_CLASSES_ROOT\MIME\Database\Content Type\video/x-mpeg]
"CLSID.BAK"="{22D6F312-B0F6-11D0-94AB-0080C74C7E95}"
"CLSID"="Deactivated"

[HKEY_CLASSES_ROOT\MIME\Database\Content Type\video/x-mpeg2a]
"CLSID.BAK"="{22D6F312-B0F6-11D0-94AB-0080C74C7E95}"
"CLSID"="Deactivated"

[HKEY_CLASSES_ROOT\MIME\Database\Content Type\video/x-msvideo]
"CLSID.BAK"="{22D6F312-B0F6-11D0-94AB-0080C74C7E95}"
"CLSID"="Deactivated"

[HKEY_CLASSES_ROOT\MIME\Database\Content Type\audio/x-pn-realaudio-plugin]
"CLSID.BAK"="{CFCDAA03-8BE4-11CF-B84B-0020AFBBCCFA}"
"CLSID"="Deactivated"

[HKEY_CLASSES_ROOT\MIME\Database\Content Type\audio/x-background]
"CLSID.BAK"="{3DA2AA3E-3D96-11D2-9BD2-204C4F4F5020}"
"CLSID"="Deactivated"

[HKEY_CLASSES_ROOT\MIME\Database\Content Type\audio/x-wav]
"CLSID.BAK"="{05589fa1-c356-11ce-bf01-00aa0055595a}"
"CLSID"="Deactivated"

[HKEY_CLASSES_ROOT\MIME\Database\Content Type\application/x-mplayer2]
"CLSID.BAK"="{22D6F312-B0F6-11D0-94AB-0080C74C7E95}"
"CLSID"="Deactivated"

[HKEY_CLASSES_ROOT\MIME\Database\Content Type\application/x-mix-transfer]
"CLSID.BAK"="{10000000-0000-0000-0000-000000000001}"
"CLSID"="Deactivated"

[HKEY_CLASSES_ROOT\MIME\Database\Content Type\application/pdf]
"CLSID.BAK"="{CA8A9780-280D-11CF-A24D-444553540000}"
"CLSID"="Deactivated"

[HKEY_CLASSES_ROOT\MIME\Database\Content Type\message/rfc822]
"CLSID.BAK"="{3050F3D9-98B5-11CF-BB82-00AA00BDCE0B}"
"CLSID"="Deactivated"

---

into your editor, save it in a file called mime.reg and execute.