Win32/Klez Worm

 Information about the Win32/Klez worm:

Win32/Klez is an email worm. This worm will infect Windows systems. The worm arrives from any of the following email addresses :

king@21cn.com
flag@21cn.com
super@21cn.com
zhangcheng77@online.sh.cn
broused@online.sh.cn
lbhuangsy@21cn.com
kqlbaby@21cn.com
jiemin@citiz.net
feiyiming@citiz.net
lllwww@online.sh.cn
tomyjiang18@21cn.com
luxianchu@21cn.com
kqlbaby@21cn.com
lin_yuezhi@citiz.net
zhangcheng77@online.sh.cn
zbzwy@21cn.com
sarge2010@21cn.com

The worm arrives with any of the following subject :

Hi
Hello
How are you?
Can you help me?
We want peace
Where will you go?
Congratulations!!!
Don't cry
Look at the pretty
Some advice on your shortcoming
Free XXX Pictures
A free hot porn site
Why don't you reply to me?
How about have dinner with me together?
Never kiss a stranger

Content of the mail will be:
I'm sorry to do so,but it's helpless to say sorry. I want a good job,I must support my parents. Now you have seen my technical capabilities. How much my year-salary now? NO more than $5,500. What do you think of this fact? Don't call my names,I have no hostility. Can you help me?

It carries a infected attachment with random filename. Upon execution of the attachment, it copies itself to Windows\System directory as KRN132.EXE. It modifies the registry at the following locations to run itself at the startup.

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run

It alsos contains a worm called Win95/Elkern. It drops a file WQK.EXE into the Windows\system directory. The registry key is created at

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run

The worm tries to spread using open network shares. Due to the bug in the program, it fails to spread.

This worm first appeared during October 2001.

 Other names of Win32/Klez worm:

This worm is also known as I-Worm.Klez, W32.Klez, W32/Klez.