Bill Williams (IT): Support Site
[home]
|
[profile]
|
[register]
|
[help]
|
[Contact Us]
Revise: Klez Virus Worm
Note: You must be registered in order to post a Topic or Comment.
To register,
click here
.
Note: Only the poster of this message, and the moderator can edit the message.
Your UserName:
Your Passkey:
Forgot your passkey?
[Click Here]
Subject:
Byline:
for Staff use.
Body Text:
For a guide to
embellishing
the text,
click
here
[h2]Klez Virus Worm[/h2] Here is the description of the virus, from the Norton website, so that you can recognise its eMails. Note the nasty trick near the bottom where a virus pretends to be a fix for Klez. Note that to prevent it (and similar viruses) infecting your computer by merely looking at the email, if you are using Windows and Outlook Express or Outlook as your email program you should upgrade to at least IE5.5 Service Pack 2 [a]http://www.microsoft.com/windows/ie/downloads/recommended/ie55sp2/default.asp[/a] plus a suitable patch available at http://www.microsoft.com/technet/security/bulletin/MS01-020.asp . {These upgrades work on all Windows from Win95 to Win2000. Not needed in WinXP}. However that patch has been superceded and it is best to use this one http://www.microsoft.com/technet/treeview/default.asp?url=/technet/security/bulletin/MS02-023.asp [a]http://www.microsoft.com/technet/treeview/default.asp?url=/technet/security/bulletin/MS02-023.asp[/a]] {also needed for IE 6 in Win-XP} Bill ========= [red] W32.Klez.H@mm This worm searches the Windows address book, the ICQ database, and local files for email addresses. The worm sends an email message to these addresses with itself as an attachment. The worm contains its own SMTP engine and attempts to guess at available SMTP servers. For example, if the worm encounters the address user@abc123.com it will attempt to send email via the server smtp.abc123.com. The subject line, message bodies, and attachment file names are random. The From address is randomly-chosen from email addresses that the worm finds on the infected computer. In addition to the worm attachment, the worm also may attach a random file from the computer. The file will have one of the following extensions: mp8 .txt .htm .html .wab .asp .doc .rtf .xls .jpg .cpp .pas .mpg .mpeg .bak .mp3 .pdf As a result, the email message would have 2 attachments, the first being the worm and the second being the randomly-selected file. The email message that this worms sends is composed of "random" strings. The subject can be one of the following: Undeliverable mail--"[Random word]" Returned mail--"[Random word]" a [Random word] [Random word] game a [Random word] [Random word] tool a [Random word] [Random word] website a [Random word] [Random word] patch [Random word] removal tools how are you let's be friends darling so cool a flash,enjoy it your password honey some questions please try again welcome to my hometown the Garden of Eden introduction on ADSL meeting notice questionnaire congratulations sos! japanese girl VS playboy look,my beautiful girl friend eager to see you spice girls' vocal concert japanese lass' sexy pictures The random word will be one of the following: new funny nice humour excite good powful WinXP IE 6.0 W32.Elkern W32.Klez.E Symantec Mcafee F-Secure Sophos Trendmicro Kaspersky The body of the email message is random. NOTES: Because this worm uses a randomly chosen address that it finds on an infected computer as the "From:" address, numerous cases have been reported in which users of uninfected computers received complaints that they sent an infected message to someone else. For example, Linda Anderson is using a computer that is infected with W32.Klez.H@mm. Linda is not using a antivirus program or does not have current virus definitions. When W32.Klez.H@mm performs its emailing routine, it finds the email address of Harold Logan. It inserts Harold's email address into the "From:" portion of an infected message that it then sends to Janet Bishop. Janet then contacts Harold and complains that he sent her an infected message, but when Harold scans his computer, Norton AntiVirus does not find anything--as would be expected--because his computer is not infected. If you are using a current version of Norton AntiVirus and have the most recent virus definitions, and a full system scan with Norton AntiVirus set to scan all files does not find anything, you can be confident that your computer is not infected with this worm. There have been several reports that, in some cases, if you receive a message that the virus has sent using its own SMTP engine, the message appears to be a "postmaster bounce message" from your own domain. For example, if your email address is jsmith@anyplace.com, you could receive a message that appears to be from postmaster@anyplace.com, indicating that you attempted to send email and the attempt failed. If this is the false message that is sent by the virus, the attachment includes the virus itself. Of course, such attachments should not be opened. The message may be disguised as an immunity tool. One version of this false message is as follows: [quote] Klez.E is the most common world-wide spreading worm. It's very dangerous by corrupting your files. Because of its very smart stealth and anti-anti-virus technic,most common AV software can't detect or clean it.We developed this free immunity tool to defeat the malicious virus. You only need to run this tool once,and then Klez will never come into your PC. NOTE: Because this tool acts as a fake Klez to fool the real worm,some AV monitor maybe cry when you run it. If so,Ignore the warning,and select 'continue'. If you have any question,please mail to me. [/quote] If the message is opened in an unpatched version of Microsoft Outlook or Outlook Express, the attachment may be automatically executed. Information about this vulnerability and a patch are available at http://www.microsoft.com/technet/security/bulletin/MS01-020.asp Virus Insertion: This worm inserts the virus W32.Elkern.4926 as a file with a random name in the \%Program Files% folder and executes it. [/red]
Check here to include your profile signature.
Check here Remember Details.
Go to Home Page