Silicon Valley - Public Access Link

Klez Worm/Virus

Klez Worm/Virus

Note that this worm is quite active now with several variants.  In one variation it arrives in your mailbox claiming to be a anti-virus software to protect against the Klez virus. The email address may be forged to appear to be from a legitimate virus vendor. Other variations contain randomly selected subjects. Opening this email is sufficient to launch this virus. Once launched this worm mass mails itself to everyone in your Outlook address book.

Vulnerable Systems

This worm only affects users of Microsoft Outlook running under Windows 95, 98, NT, Me, 2000 or XP.

Impact

This worm mass mails itself to users listed in your address book, thereby spreading itself to other computers. It may also attach copies of files from your computer in its emails thereby compromising your privacy.

What to Look For

In one variant worm email contains the subject: "Klez Worm immunity". Other variations include the following subjects where "[Random word]" varies: 
    Undeliverable mail--"[Random word]"
Returned mail--"[Random word]"
a [Random word] [Random word] game
a [Random word] [Random word] tool
a [Random word] [Random word] website
a [Random word] [Random word] patch
[Random word] removal tools
how are you
let's be friends
darling
so cool a flash,enjoy it
your password
honey
some questions
please try again
welcome to my hometown
the Garden of Eden
introduction on ADSL
meeting notice
questionnaire
congratulations
sos!
japanese girl VS playboy
look,my beautiful girl friend
eager to see you
spice girls' vocal concert
japanese lass' sexy pictures

Certain attachments contain programs (EXE/COM/BAT/LNK/PIF or SCR) and can be dangerous to open. Be clear on what the attachment is before opening it.

Solutions

Install patches to your copy of Outlook to protect against a number of security problems and virus threats. See Microsoft's Window Update web site for easy updating of your Microsoft software. Install a virus scanner to provide additional protection.

For more information

Check the CERT Coordination Center for more information on this worm.  Or check SVPAL's virus page for me general virus protection information.

[SVPAL Home]  [Subscriber]

Contact Silicon Valley Public Access Link
Last updated: February 23, 2006