# MA-040.042002: MyCERT Advisory - W32.Klez@MM Worm

**Date:** 26 Apr 2002  
**Source:** https://www.mycert.org.my/portal/advisory?id=MA-040.042002  
**Advisory ID:** MA-040.042002

---

1.Description
#### 1.1 Overview
W32.Klez@mm worm is a mass-mailing email worm. It attempts to copy itself into folders on both local and network drives. The worm exploits a vulnerability in Microsoft Outlook and Outlook Express in an attempt to execute itself when you open or even preview the message.
It started with Klez.A, followed by Klez.D(which also known as Klez.B) and Klez.E. Then the variants continue with Klez.G, Klez.I, Klez.K (aliases name for Klez.H and have similarities with Klez.H.)
The risk assessment by many anti-virus vendors, for this worm has been graded to a MEDIUM risk.
#### 1.2 Systems Affected
Microsoft Outlook, Outlook Express, Microsoft Internet Explorer 5.01 and Microsoft Internet Explorer 5.5
#### 1.3 Limitation
1.3.1 No limitation. It does not require the email receiver to open the attachment for it to execute.
#### 1.4 Variants
The variants of W32.Klez@mm worm are:
1. Klez.A, followed by
2. Klez.D(which also known as Klez.B)
3. Klez.E. Then the variants continue with
4. Klez.G, (aliases name for Klez.H and have similarities with Klez.H.)
5. Klez.I, (aliases name for Klez.H and have similarities with Klez.H.)
6. Klez.K (aliases name for Klez.H and have similarities with Klez.H.)
#### 1.5 Payload
1.5.1 Sending emails out to large number of people. This is usually done by accessing a local address book and sending emails to a certain number of people within that address book. Klez worm also spoofs the "From" information in the e-mails the virus sends.
1.5.2 The worm contains its own SMTP engine and attempts to guess at available SMTP servers. For example, if the worm encounters the address [[email protected]](/cdn-cgi/l/email-protection) it will attempt to send email via the server smtp.xyz.com.
1.5.3 Disable most common antivirus software's capabilities to detect and clean this worm
1.5.4 Modifies files, occurs on the 13th or 6th of every odd months (example January, March), filling infected files with zeroes/overwrite with zero bytes
Infects shared and mapped drives - overwrite files and copies itself to local, mapped and network drives as file with double extension(example: file.txt.exe).
Release confidential info by sending email with attachment that is picked randomly from infected PC.
All of these variants have a number of similarities which are:
1. to exploit a vulnerability in Microsoft Outlook and Outlook Express
2. attempts to unload several processes (antivirus programs) from memory e-mail to addresses found in address book.
### 2.0 Technical Matters
#### Symptoms of infection
2.1.1 Randomly/oddly named files on network shares
- Reference to a WINKxxx.EXE file ("xxx" looks random) in a Registry key:
HKEY\_LOCAL\_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
2.1.2 Normally well-behaved programs function abnormally or crash without reason.
Examples:
- PC always hangs when using Microsoft Word.
- Microsoft Office application such as Words and Excel need a converter to display file correctly.
- Error starting program-starting, not enough memory to start certain program.
2.1.3 Files are replaced with zero characters or zero bytes.
### 3.0 Possible Steps
#### 3.1 Prevention
3.1.1 Remove or turn off any unneeded services. If a blended threat exploits one or more network services, disable, or block access to, those services until a patch is applied.
3.1.2 Ensure up-to-date patches installed (using MS01-020 to prevent emails from being able to automatically launch executable attachments), especially on computers that host public services such as HTTP, FTP, mail, and DNS services. Information and a patch for the vulnerability can be found at:
http://www.microsoft.com/technet/security/bulletin/MS01-020.asp
3.1.3 Block or remove email on mail server that contains file attachments that are commonly used to spread viruses, such as .vbs, .bat, .exe, and .src files.
3.1.4 Isolate infected computers quickly to prevent further compromises and restore relevant data from trusted media.
3.1.5 Do not to open attachments unless the attachment has been scanned for virus or malicious codes.
3.1.6 Do not execute software that is downloaded from the Internet unless it has been scanned for viruses or downloaded from trusted source.
3.1.7 Upgrade to Internet Explorer 6
3.1.8 Close any sharing files/folder/directory. When sharing files/folder/directory,do not give full access(read and write).Settle for read only instead. Add password authentication for access authorization to shared resources.
#### 3.2 Detection
Any antivirus with the latest virus definitions is able to detect the worm.To detect the virus, run an antivirus scan with the latest signature file on your system. Ensure the anti-virus is configured to scan ALL FILES.
Note: This worm has the capabilities to disable the functions of some common anti-virus softwares to detect this worm.
#### 3.3 Removal
To remove the worm from the infected computers, choose between automatic or manual removal method, in which the respective tools and procedures are given below:
**3.3.1 Automatic Removal:**
There are a few tools which can be used to remove the worm from the infected computer. Any one of the tools below can be used to detect and remove the worm.
**Symantec removal tool**
http://securityresponse.symantec.com/avcenter/venc/data/w32.klez.removal.tool.html
http://securityresponse.symantec.com/avcenter/FixKlez.com
**F-prot removal tool**
ftp://ftp.europe.f-secure.com/anti-virus/tools/kleztool.zip
**What the tools do:**
1. terminate all the worm processes
2. delete the infected file (if can be repaired it will repair the file)
3. remove the registry entries(which was created by the worm)
4. detect any suspicious activities /infections
Note: For medium to large scale networked organization which are suffering from klez worm infection, please refer to Worm Incident Handling SOP for recommended Incident Handling procedures for effective worm eradication in the network.
**3.3.2 Manual Removal:Remove manually all the infected files**
3.3.2.1 Isolate the infected machine by disconnecting the machine from the network.
3.3.2.2 Close any sharing files/folder/directory. When sharing files/folder/directory,do not give full access(read and write).Settle for read only instead. Add password authentication for access authorization to shared resources.
3.3.2.3 Run an anti-virus to detect the presence of the worm. Ensure the anti-virus is updated with latest virus definitions.
Note: This worm disables the functions of some common anti-virus softwares to detect and clean this worm.
3.3.2.4 Restart computer in safe modeTo restart Windows 95/98 in Safe Mode:
1. Restart the computer.
2. Press F8 until Microsoft Windows Startup Menu appears.
3. Select "safe mode". Then the windows start in Safe Mode.
**Edit the registry**
1. Go to 'start'.
2. Click 'run'. The run dialog appears
3. Type 'regedit' and then click ok.
4. Registry Editor appears
5. Edit the key:
- "HKEY\_LOCAL\_MACHINE\Software\Microsoft\Windows\Current Version\Run"
- In the right pane, look for the following values:
Wink[random characters].exe
Wqk.exe
- Delete the wink[random characters].exe value and wqk value if it exists
6. Edit:
- "HKEY\_LOCAL\_MACHINE\System\CurrentControlSet\Services"
- In the left pane, under the \Services key, look for the following subkey, and delete it, if it exists:
- Wink[random characters].exe
Wqk.exe
- Delete the wink[random characters].exe and wqk if it exists
- Click Registry, and click Exit.
7. Go to Windows Explorer.
- open the C:\Windows\System folder
- search for Wink[random characters].exe file. and delete the file.
NOTE: If you have Windows installed to a location other than C:\Windows, make the appropriate substitution.
8. Empty the recycle bin
Right-click the Recycle bin on the Windows desktop, and click Empty Recycle Bin.
3.3.3 Restart the computer.
3.3.4 Re-scan the machine to make sure the machine has been cleaned completely. If there are still infected files, delete them. Please make sure you write down the filename before delete if you want to reinstall the file later.
3.3.5 Re-connect the machine to the network.
3.3.6 Take preventive measures against such worms as detailed in section 3.1 of this advisory.
- Safe email practices. Pls refer at:
[https://www.mycert.org.my/portal/articles-content?menu=4b05e0fb-afa1-408f-90ca-ea0edf4aca8b&id=96fa0022-2ca9-47cb-975f-0d1225cc278e](https://www.mycert.org.my/portal/articles-content?menu=4b05e0fb-afa1-408f-90ca-ea0edf4aca8b&id=96fa0022-2ca9-47cb-975f-0d1225cc278e
)
### 4.0 More Information
More information on this virus can be obtained from the following sites:
4.1 **Mcafee:**
http://vil.nai.com/vil/content/v\_99455.htm
http://vil.nai.com/vil/content/v\_99367.htm
http://vil.nai.com/vil/content/v\_99237.htm
4.2 **Norman:**
http://www.norman.com/virus\_info/w32\_klez\_a\_mm.shtml
4.3 **Symantec:**
http://securityresponse.symantec.com/avcenter/venc/data/[[email protected]](/cdn-cgi/l/email-protection)
http://securityresponse.symantec.com/avcenter/venc/data/[[email protected]](/cdn-cgi/l/email-protection)
http://securityresponse.symantec.com/avcenter/venc/data/[[email protected]](/cdn-cgi/l/email-protection)
4.4 **F-secure:**
http://www.europe.f-secure.com/v-descs/klez\_h.shtml
http://www.europe.f-secure.com/v-descs/klez\_e.shtml
4.5 **Sophos:**
http://www.sophos.com/virusinfo/analyses/w32klez.html
http://www.sophos.com/virusinfo/analyses/w32kleze.html