Some Vital Information on the Latest Klez Worm
Posted on 23.04.2002
Klez.h (aka Klez.g) is the latest worm in the Klez family.

The subject lines and message bodies, for instance, have been expanded and made even more random than previous versions, Sharon Ruckman, director of Symantec's security response team, said to InfoWorld. The virus also seems to have been designed to stop or disable a greater range of antivirus tools than older versions. In addition, the Elkern virus it carries has been modified to do more damage.

Some of the active applications it tries to find are:

_AVP32, _AVPCC, _AVPM, ALERTSVC, AMON, AVP32, AVPCC, AVPM, N32SCANW, NAVAPSVC, NAVAPW32, NAVLU32, NAVRUNR, NAVW32, NAVWNT, NOD32, NPSSVC, NRESQ32, NSCHED32, NSCHEDNT, NSPLUGIN, SCAN, SMSS


Worm can also be detected by a registry key it creates to start itself:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run Krn132 = %System%\Krn132.exe

The worm searches several registry keys for links to applications and then it tries to infect them.

These are some of the sentences that it ads to message bodies of infected e-mails.

- I'm sorry to do so,but it's helpless to say sory.
- I want a good job,I must support my parents.
- Now you have seen my technical capabilities.
- How much my year-salary now? NO more than $5,500.
- What do you think of this fact?
- Don't call my names,I have no hostility.
- Can you help me?


References:

- InfoWorld: New variant of Klez worm detected
- News.com: New Klez worm squirms across Internet
- Kaspersky Labs: I-Worm.Klez.a-h (Klez Family)
- Sophos: Sophos users already protected against Klez.H
- McAfee: W32/Klez.h@MM Removal Instructions





Spotlight

Targeted attack protection via network topology alteration

Posted on 17 October 2014.  |  This article from Trend Micro tackles how network topology can aid in defending the enterprise network from risks posed by targeted attacks.


Weekly newsletter

Reading our newsletter every Monday will keep you up-to-date with security news.
  



Daily digest

Receive a daily digest of the latest security news.
  

DON'T
MISS

Mon, Oct 20th
    COPYRIGHT 1998-2014 BY HELP NET SECURITY.   // READ OUR PRIVACY POLICY // ABOUT US // ADVERTISE //