Sign up for the ITPro Today newsletter
Stay on top of the IT universe with commentary, news analysis, how-to's, and tips delivered to your inbox daily.
JSI Tip 6197. How do I identify, recover from, and prevent infections from the W32.Klez worm virus?
Jerold Schulman
January 8, 2003
6 Min Read
NOTE: The text in the following Microsoft Knowledge Base article is provided so that the site search can find this page. Please click the Knowledge Base link to insure that you are reading the most current information.
Microsoft Knowledge Base article Q811010 contains:
SUMMARY
This article describes how to determine if your computer is infected with the W32.Klez.gen@mm (W32.Klez) worm virus, how to recover from an infection, and how to prevent future infections with this virus.
W32.Klez is a mass-mailing worm that searches for e-mail addresses and sends messages to all the recipients that it finds. The subject and attachment name of the e-mail messages are randomly chosen. The attachment has one of the following extensions:
.bat
.exe
.pif
.scr
The worm exploits a vulnerability in Microsoft Outlook and Outlook Express that was first fixed in the following Microsoft Security Bulletin:
Microsoft Security Bulletin MS01-020
The worm tries to run itself when you open or preview the e-mail message. You do not have to open the attachment for the worm to run. For additional information about this update, click the following article number to view the article in the Microsoft Knowledge Base:
290108 Incorrect MIME Header Can Cause Internet Explorer to Run E-mail Attachment
MORE INFORMATION
Microsoft does not provide software that can detect or remove computer viruses. If you suspect or confirm that your computer is infected with a virus, obtain current antivirus software. For a list of antivirus software manufacturers, click the following article number to view the article in the Microsoft Knowledge Base:
49500 List of Antivirus Software Vendors
Symptoms of W32.Klez Infection
Antivirus software indicates W32.Klez.gen@mm ispresent.
Programs do not function as expected or they stopunexpectedly, for example:
When you use Microsoft Word, the computer stops responding (hangs).
Microsoft Office programs such as Word and Microsoft Excel must use a converter to display the file correctly.
You receive the following error message when you start a program: Starting, not enough memory to start certain program
Windows-based programs run very slowly.
Documents do not open properly, or when they open, they donot contain all the correct information.
You cannot start Windows Task Manager.
Note To start Task Manager, right-click a blank area of the taskbar,and then click Task Manager.Your antivirus program no longer runs.
A file named Krn132.exe exists in the C:WindowsSystemfolder.
There is a reference to a file namedWinkxxx.exe in a registry key (wherexxx is a random value). To confirm this behavior:
Quit all running programs.
Click Start, click Run, type msconfig in the Open box, and then click OK.
Click the Services tab, and then click to select the Hide All Microsoft Services check box.
In the list of running services, determine if the following service is running:
Winkxxx, where xxx is two to three random characters appended to the word Wink, for example, Winkap, Winkzfu, or Winknwk.
Recovering from and Preventing a W32.klez Infection
Scan your computer with an updated antivirus program. Ifyou do not have an antivirus program installed, Trend Micro, Inc. offers a freeonline virus scanning service at the following Trend Micro Web site:
http://housecall.trendmicro.com/housecall/start_corp.aspRun a W32.Klez removal tool. A number of antivirus vendorsoffer free tools to remove W32.Klez virus infections. The following listdescribes two ways to obtain these tools:
Visit the following Symantec Web site: http://securityresponse.symantec.com/avcenter/venc/data/w32.klez.removal.tool.html
Download, extract, and then run the following F-Secure tool:ftp://ftp.europe.f-secure.com/anti-virus/tools/kleztool.zip
These tools perform the following tasks:
They quit all processes used by the virus.
They delete (or repair if possible) any infected files.
They remove registry entries created by the virus.
They detect any suspicious activities or infections.
If you are running a version of Internet Explorer earlierthan Internet Explorer 5.01 Service Pack 2 (SP2), install the update that isdescribed at the following Microsoft Web site:
MicrosoftSecurity Bulletin MS01-020
For additional information about this update, click the following article number to view the article in the Microsoft Knowledge Base:
290108 Incorrect MIME Header Can Cause Internet Explorer to Run E-mail Attachment
To obtain all the latest security patches, visit thefollowing Windows Update Web site:
http://windowsupdate.microsoft.com
.Reinstall your antivirus program (if it stoppedworking).
Make sure your antivirus software is up to date, and thenre-scan your computer to make sure that the virus has been removed completely.For a list of antivirus vendors, click the article number below to view thearticle in the Microsoft Knowledge Base:
49500 List of Antivirus Software Vendors
.Turn off Active Scripting in Outlook and Outlook Express.
Outlook Express 4.x
Start Outlook Express.
On the Tools menu, click Options.
On the Security tab, click Restricted sites zone in the Zone box, and then click Settings.
When you are notified that you are about to change the security settings, click OK.
Click Custom (for expert users).
Click Disable under Active scripting in the Scripting area.
Click OK, click OK, and then click OK.
Outlook Express 5.x
Start Outlook Express.
On the Tools menu, click Options.
On the Security tab, click Restricted sites zone, and then click OK.
Start Internet Explorer.
On the Tools menu, click Internet Options.
On the Security tab, click Restricted sites, and then click Custom Level.
Click Disable under Active Scripting in the Scripting area.
Click OK, click Yes if you are prompted, and then click OK.
Outlook Express 6.x
Start Outlook Express.
On the Tools menu, click Options.
On the Security tab, under Virus Protection, click either Restricted Sites Zone (More secure) or Internet Zone (Less secure, but more functional) under Select the Internet Explorer security zone to use.
Click to select the Warn me when other applications try to send mail as me check box.
Click to select the Do not allow attachments to be saved or opened that could potentially be a virus check box.
Click OK.
Outlook 2000 and 2002
Start Outlook.
On the Tools menu, click Options.
On the Security tab, click Restricted sites in the Zone box, and then click OK.
Click Zone Settings.
Click OK to confirm that you want to change Internet Explorer security settings.
On the Security tab, click Restricted sites, and then click Custom Level.
Click Disable under Active Scripting in the Scripting area.
Click OK, click Yes if you are prompted, and then click OK.
Click OK.
Hide the Preview pane (if it is visible). To do so, click View, and then click Preview Pane.
If you are using Outlook 2000 Service Pack 1 (SP1) or an earlier version of Outlook, install the Outlook E-mail Security Update. For additional information about this update, click thefollowing article number to view the article in the Microsoft Knowledge Base:
235309 Outlook E-mail Attachment SecurityUpdate
REFERENCES
For additional information about this virus, click the following article number to view the article in the Microsoft Knowledge Base:
316658 OL2000: VIRUS ALERT: The w32.klez.e@mm "Klez" Virus
323037 WD: Text Is Displayed as Unreadable Symbols When You Open a Document
For information about this virus, visit the following third-party Web sites:
Mcafee
http://vil.nai.com/vil/content/v_99455.htm
http://vil.nai.com/vil/content/v_99367.htm
http://vil.nai.com/vil/content/v_99237.htm
Norman
http://www.norman.com/virus_info/w32_klez_a_mm.shtml
Symantec
http://securityresponse.symantec.com/avcenter/venc/data/[email protected]
http://securityresponse.symantec.com/avcenter/venc/data/[email protected]
http://securityresponse.symantec.com/avcenter/venc/data/[email protected]
F-secure
http://www.europe.f-secure.com/v-descs/klez_h.shtml
http://www.europe.f-secure.com/v-descs/klez_e.shtml
Sophos
http://www.sophos.com/virusinfo/analyses/w32kleze.html
Microsoft provides third-party contact information to help you find technical support. This contact information may change without notice. Microsoft does not guarantee the accuracy of this third-party contact information.
About the Author
You May Also Like
.jpg?width=700&auto=webp&quality=80&disable=upscale)
