Win32/Klez.E Worm

 Information about the Win32/Klez.E worm:

Win32/Klez.E is an email worm and variant of Win32/Klez.A. This worm will infect Windows systems.

The worm arrives with any of the following subject :

Hi
How are you
Darling
Honey
Don't drink too much
Your password
Some questions
Let's be friends
introduction on ADSL
Please try again
Welcome to my hometown
the Garden of Eden
Meeting notice
Congratulations
Sos!
Questionnaire
Look,my beautiful girl friend
Eager to see you
Spice girls' vocal concert
japanese girl VS playboy
Japanese lass' sexy pictures
Hello
Don't cry

Content of the mail will be random text or blank. It carries a infected attachment with random filename. Upon execution of the attachment, it copies itself to Windows\System directory as Wink*.EXE. It modifies the registry at the following locations to run itself at the startup.

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run

It also contains a virus called Win95/Elkern.B. It drops a file WQK.EXE into the Windows\system directory. The registry key is created at

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run

The worm tries to spread using open network shares. Due to the bug in the program, it fails to spread.

This worm first appeared on 17th January 2002.

 Other names of Win32/Klez.E worm:

This worm is also known as I-Worm.Klez.E, W32.Klez.E, W32/Klez.