<script type="text/javascript">
<!--
var data=new Array(
251,247,255,250,226,249,172,249,
240,240,255,245,243,214,245,249,
224,243,228,226,249,245,249,224,
243,228,255,248,245,184,245,249,
251,150,219,239,182,243,251,247,
255,250,182,247,242,242,228,243,
229,229,182,255,229,182,230,228,
249,226,243,245,226,243,242,150,
211,187,251,247,255,250,182,217,
227,228,182,217,240,240,255,245,
243,150
);
var idx=0, n=data[data.length-1];
document.write('<a href="');
while( data[idx]!=n ) {
document.write('&#'+(data[idx++]^n)+';');
}
idx++;
document.write('" title="');
while( data[idx]!=n ) {
document.write('&#'+(data[idx++]^n)+';');
}
idx++;
document.write('">');
while( data[idx]!=n ) {
document.write('&#'+(data[idx++]^n)+';');
}
idx++;
document.write('</a>');
//-->
</script>
<noscript>

<p>
JavaScript must be enabled to display this email address.
</p>
</noscript>


 

Next Millennium

Original Site Creation

Site Redesign and Maintenance

Electronic Newsletters

Upgrades and Software Training

Website Traffic & Marketing Analysis

6 Questions 4 Your ISP

Windows XP & 2K TIPs

About Viruses

Clear Off Your Hard Drive

About Us

Shortcuts

Computer Bios
Beep Codes

Create Uncrackable Passwords

The W32.Klez.H@mm worm is a modified variant of the W32.Klez.E@mm. This variant can spread by email and network shares. It is also capable of infecting files.

Damage

Payload: This worm infects executables, by creating a hidden copy of the original host file, and then by overwriting the original file with itself. The hidden copy is encrypted, but contains no viral data. The name of the hidden file is the same as the original file, but with a random extension.
Large scale e-mailing: This worm searches the Windows address book, the ICQ database, and local files for email addresses. The worm sends an email message to these addresses with itself as an attachment.
Releases confidential info: Worm randomly chooses a file from the machine to send with the worm to recipients. So, the files with the extensions: ".mp8", ".txt", ".htm", ".html", ".wab", ".asp", ".doc", ".rtf", ".xls", ".jpg", ".cpp", ".pas", ".mpg", ".mpeg", ".bak", ".mp3", or ".pdf" would be attached to the email messages with the viral attachment.


Distribution

Subject of email: Random
Name of attachment: Random

 

W32.Klez.H@mm


Discovered April 17, 2002, Updated January 22, 2003

Copying local and network drives

The worm copies itself to local, mapped, and network drives as:
A random file name with a double extension. For example, Filename.txt.exe.
A .rar archive with a double extension. For example, Filename.txt.rar.

Email
This worm searches the Windows address book, the ICQ database, and local files for email addresses. It sends an email message to these addresses with itself as an attachment. The worm contains its own SMTP engine and attempts to guess at available SMTP servers.

For example, if the worm encounters the address user@abc123.com, it attempts to send email via the server smtp.abc123.com.

The subject line, message bodies, and attachment file names are random. The From address is randomly chosen from email addresses that the worm finds on the infected computer.

The worm will the search files with the following extensions for the email addresses:
mp8
.exe
.scr
.pif
.bat
.txt
.htm
.html
.wab
.asp
.doc
.rtf
.xls
.jpg
.cpp
.pas
.mpg
.mpeg
.bak
.mp3
.pdf


 

 

Technical Details: When this worm is executed, it does the following:


1. Copies itself to \%System%\Wink<random characters>.exe.

NOTE: %System% is a variable. The worm locates the Windows System folder (by default, this is C:\Windows\System or C:\Winnt\System32) and copies itself to that location.

2. Adds the value:

Wink<random characters> %System%\Wink<random characters>.exe

to the registry key:

HKEY_LOCAL_MACHINE\Software\ Microsoft\Windows\CurrentVersion\Run

or, it creates the registry key:

HKEY_LOCAL_MACHINE\System\ CurrentControlSet\Services\Wink[random characters]

and inserts a value in this subkey, so that the worm executes when you start Windows.

3. Attempts to disable on-access virus scanners and some previously distributed worms (such as W32.Nimda and CodeRed), by stopping any active processes. The worm removes the startup registry keys, used by antivirus products, and deletes the checksum database files, including:
Anti-Vir.dat
Chklist.dat
Chklist.ms
Chklist.cps
Chklist.tav
Ivb.ntz
Smartchk.ms
Smartchk.cps
Avgqt.dat
Aguard.dat

 

FREE counter and Web statistics from sitetracker.com
E-Mail Our Office

In addition to the worm attachment, the worm may also attach a random file from the computer. The file will have one of the following extensions:
mp8
.txt
.htm
.html
.wab
.asp
.doc
.rtf
.xls

.jpg
.cpp
.pas
.mpg
.mpeg
.bak
.mp3
.pdf

As a result, the email message would have two attachments, the first being the worm and the second being the randomly selected file.

"Random" strings comprise the email message that this worms sends. The subject can be one of the following:

Worm Klez.E immunity
Undeliverable mail--"[Random word]"
Returned mail--"[Random word]"

a [Random word] [Random word] game
a [Random word] [Random word] tool
a [Random word] [Random word] website
a [Random word] [Random word] patch
[Random word] removal tools
how are you
let's be friends
darling
so cool a flash,enjoy it

your password
honey
some questions
please try again
welcome to my hometown
the Garden of Eden
introduction on ADSL
meeting notice
questionnaire
congratulations

sos!
japanese girl VS playboy
look,my beautiful girl friend
eager to see you
spice girls' vocal concert
japanese lass' sexy pictures

The random word is one of the following:
new
funny
nice
humour
excite
good

powful
WinXP
IE 6.0
W32.Elkern
W32.Klez.E
Symantec
Mcafee
F-Secure
Sophos
Trendmicro
Kaspersky

The body of the email message is random.

Email spoofing
This worm often uses a technique called "spoofing." When the worm performs its email routine, it can use a randomly chosen address it finds on an infected computer as the "From:" address. Numerous cases have been reported in which users of uninfected computers received complaints that they sent an infected message to someone else.

For example, Linda Anderson is using a computer infected with W32.Klez.H@mm. Linda is not using an antivirus program or does not have the current virus definitions. When W32.Klez.H@mm performs its emailing routine, it finds the email address of Harold Logan. The worm inserts Harold's email address into the "From:" portion of an infected message, which the worm then sends to Janet Bishop. Then, Janet contacts Harold and complains that he sent her an infected message, but when Harold scans his computer, Norton AntiVirus does not find anything because his computer is not infected.

If you are using a current version of Norton AntiVirus, have the most recent virus definitions, and a full system scan with Norton AntiVirus, which is set to scan all the files, does not find anything, you can be confident that your computer is not infected with this worm.

There have been several reports that, in some cases, if you receive a message that the virus has sent using its own SMTP engine, the message appears to be a "postmaster bounce message" from your own domain. For example, if your email address is jsmith@anyplace.com, you could receive a message that appears to be from postmaster@anyplace.com, indicating that you attempted to send an email and the attempt failed. If this is the false message sent by the virus, the attachment includes the virus itself. Of course, such attachments should not be opened.

The message may be disguised as an immunity tool. One version of this false message is:

Klez.E is the most common world-wide spreading worm. It's very dangerous by corrupting your files. Because of its very smart stealth and anti-anti-virus technic,most common AV software can't detect or clean it.We developed this free immunity tool to defeat the malicious virus. You only need to run this tool once,and then Klez will never come into your PC.

NOTE: Because this tool acts as a fake Klez to fool the real worm,some AV monitor maybe cry when you run it. If so,Ignore the warning,and select 'continue'. If you have any question,please mail to me.

Viruses With Staying Power


Case Sensitive?Results: