Someone tells you that you sent a W32.Klez-infected email message but Norton AntiVirus does not detect the worm
Situation:
You are told that you have sent an email that has been infected by one of the variants of W32.Klez and that your computer must be infected. However, when you run a virus scan with Norton AntiVirus (NAV) using the latest virus definitions, nothing is detected.
Solution:
Variants of the W32.Klez worm spread by searching the Windows address book, the ICQ database, and all local files for email addresses. The worm puts one email address in the "To" field and one in the "From" field of an infected email message. When it sends the infected email message, it appears that a persons computer has been infected when in fact, it might be clean.
For example, Alex is using a computer that is infected with W32.Klez.H@mm. Alex is either not using an antivirus program or does not have current virus definitions. Both Beth and Chris have sent email to Alex in the past. When W32.Klez.H@mm performs its emailing routine, it finds the email addresses of Beth and Chris. It inserts Beth's email address into the "From" field of an infected message. It adds Chris's name to the "To" field and then sends the infected email to Chris. Chris then contacts Beth and complains that she sent him an infected message, but when Beth scans her computer, Norton AntiVirus does not find anything--as would be expected--because her computer is not infected.
NOTE: Because the W32.Klez worm does not use the email address of the infected computer in the email that it sends, there is no way to track which computer sent the infected email.
If you are using a current version of Norton AntiVirus and have the most recent virus definitions, and a full system scan with Norton AntiVirus set to scan all files does not find anything, then you can be confident that your computer is not infected with this worm.
