Macs and PC Worms


Question:
Are Macintosh computers susceptible to the worms being passed from one PC to another PC?

Answer:
Well, in a word, yes.

While I was in WV this summer, using my infinet account, I began receiving all these email messages "Returned Mail", "mail delivery failed", strange emails from unknown addresses with subjects like "A good time", "Lets be friends", "Japanese WomenVS Playboy", "Garden of Eden", and others. Most of these messages had attachments variously called "Japanese WomenVS Playboy, children.plf, children.asp, a good tool, and others with suffixes such as: exe,bat, htm, pig, doc, rtf, jpg, plf.

In addition, I received mail that said I was sending a virus or a worm that attached itself to the email addresses in my address book. The worm was identified as W32.Klez.H@mm. This all became very troublesome because Macs aren't supposed to get worms and because every time I logged on I got 10 or more of the nuisance messages.

I ran my Norton Anti-Virus software and it found no virus nor worm. So I went to the Symantec (Norton) site and looked up that particular worm only to find out that it doesn't infect a Macintosh computer. The knowledge base indicated that simply deleting the messages plus attachments was the only action I needed to take. They have a patch for PCs with that worm but not for a Mac.

The only problem with that info was that deleting didn't stop the number of "Returned Mail/mail delivery failed/other odious subjects" email messages. They just kept coming. I began to think that Symantek was wrong and that I really did have the "Klez worm" and was sending it to all my contacts.

So I emailed Symantec tech help and explained in detail the troubles I was having. After 2 days, a technician answered and explained that "No, you don't have the Klez worm but someone using a PC has it and is sending it out using your email address. The worm attaches itself to all the addresses in the PC address book, including your address, and sends messages with itself as an attachment, thus infecting other PC's." He suggested that changing my email address wouldn't work because sending out a "change of address" would start the process over again once the infected PC got the new address.

The solution was to find out who had the worm and kindly ask them to run their anti-virus/worm program. The address being used was my very first infinet address: writeon@x31.infi.net. So I had to narrow down the list of people using that address, which wasn't difficult because only a few still had it.

Sure enough, the culprit was a friend who likes to send/forward all kinds of junk mail! Every time I got mail from her, along came several of the worm letters! So I called her and suggested that she might have a worm on her computer and that she should investigate. She protested that she uses Norton Anti-Virus and couldn't possibly have the worm but she would contact Norton and ask their advice.

I don't know what she did - perhaps she downloaded the Klez patch - but the strange emails stopped coming and, hopefully, that will be the end of that. Until some other PC gets a worm and uses my email address to spread itself.