VIRUS INFO
Naziv virusa:	I-Worm.Klez
Alias:	W32/Klez.h@MM , W32/Klez.G@mm, WORM_KLEZ.G, W32/Klez.gen@MM, W32/Klez.I, W32/Klez.K-mm
Tip:	worm
Način širenja:	e-mailom i preko umreženih računara
Veličina:	postoji u 3 različite veličine od 57, 65 i 90 kB
Destruktivan:	da
Datum aktiviranja:	otvaranjem pristigle pošte i svakog 13 u mesecu “uništi” sve fajlove na korisnikovom računaru
Otkriven:	17.04.2002.

OBJAŠNJENJE
Stiže kao e-mail od nekoga koga poznajete.

Subject: A very funny website
ili Subject: Undeliverable mail--
ili Subject: Returned mail--
ili Subject: A WinXP patch
ili Subject: A IE 6.0 patch
ili Subject: W32.Elkern removal tools
ili Subject: W32.Klez.E removal tools
ili Subject: Hello
ili Subject: How are you?
ili Subject: Can you help me?
ili Subject: We want peace
ili Subject: Where will you go?
ili Subject: Congratulations!!!
ili Subject: Don't cry
ili Subject: Look at the pretty
ili Subject: Some advice on your shortcoming
ili Subject: Free XXX Pictures
ili Subject: A free hot porn site
ili Subject: Why don't you reply to me?
ili Subject: How about have dinner with me together?
ili Subject: Never kiss a stranger
ili Subject: I'm sorry to do so,but it's helpless to say sory.
ili Subject: I want a good job,I must support my parents.
ili Subject: Now you have seen my technical capabilities.
ili Subject: How much my year-salary now? NO more than $5,500.
ili Subject: What do you think of this fact?
ili Subject: Don't call my names,I have no hostility.
ili Subject: Can you help me?

Attachment: je neki nasumični naziv fajla koji ima ekstenziju EXE, SCR, PIF, BAT, TXT, HTM, HTML, WAB, ASP, DOC, RTF, XLS, JPG, CPP, C, PAS, MPG, MPEG, BAK, MP3 ili PDF.

Telo poruke može biti sledeće sadržine (u zavisnosti od Subjecta)
This game is my first work.
You're the first player.
I wish you would enjoy it.

This is a new game
This game is my first work.
You're the first player.
I wish you would enjoy it.

This is a funny website
I hope you would enjoy it.

Hello,This is a powful tool
I hope you would enjoy it.

Hello,This is a IE 6.0 patch
I hope you would enjoy it.

Kaspersky give you the very W32.Elkern removal tools
W32.Elkern is a very dangerous virus that can infect on

W32.Klez.E is a dangerous virus that spread through email.
Kaspersky give you the W32.Klez.E removal tools
For more information,please visit http://www.Kaspersky.com

Kada se pristiglo pismo otvori, virus kreira fajl %System%\KRN132.EXE i dodaje sledeći ključ u Registry bazu:
HKEY_LOCAL_MACHINE \Software\Microsoft\Windows\CurrentVersion\Run Krn132 = %System%\Krn132.exe

gde je %System% naziv Windows sistemskog direktorijuma. Po standardnom podešavanju je to C:\WINDOWS\SYSTEM.

Virus skenira sve startovane aplikacije i ako u memoriji pronađe neki od navedenih sa spiska:
_AVP32; _AVPCC; NOD32; NPSSVC; NRESQ32; NSCHED32; NSCHEDNT; NSPLUGIN; NAV; NAVAPSVC; NAVAPW32; NAVLU32; NAVRUNR; NAVW32; _AVPM; ALERTSVC; AMON; AVP32; AVPCC; AVPM; N32SCANW; NAVWNT; ANTIVIR; AVPUPD; AVGCTRL; AVWIN95; SCAN32; VSHWIN32; F-STOPW; F-PROT95; ACKWIN32; VETTRAY; VET95; SWEEP95; PCCWIN98; IOMON98; AVPTC; AVE32; AVCONSOL; FP-WIN; DVP95; F-AGNT95; CLAW95; NVC95; SCAN; VIRUS; LOCKDOWN2000; Norton; Mcafee i Antivir
odmah će ih zatvoriti.

Da bi se proširio i na sve računare koji su umreženi, sa sada već zaraženog računara, virus kreira fajl WINKxxx.EXE, gde xxx predstavljaju nasumično odabrana slova. Veličina ovog fajla je oko 180 kB. U samom fajlu se nalazi kôd virusa "Win32.Klez". Po završenom kreiranju virusa, biva odmah aktiviran na svim umreženim računarima. Ovaj virus inficira sve EXE fajlove.

Neke varijanete ovog virusa kreiraju fajlove
350.bak.scr; bootlog.jpg; user.xls.exe; HREF.mpeg.rar; HREF.txt.rar i lmbtt.pas.rar
da bi se virus proširio na sve umrežene računare.

Svakog 13 u mesecu virus svim fajlovima na korisnikovom računaru izmeni sadržaj dodajući nasumično odabran sadržaj. Ovim postupkom su SVI fajlovi onesposobljeni za bilo kakav oporavak. Jedina metoda oporavka je backup.

Virus se sam šalje na sve e-mail adrese koje postoje u korisnikovom Address Booku. Napisan je u Microsoft Visual C++.

REŠENJE
Kada se korisnik zarazi ovim virusom, nijedan AV program koji ima na svom računaru mu neće pomoći, jer to virus ne dozvoljava.
Rešenje je da svoj hard disk odnesete kod nekoga ko ima na svom računaru osvežen AV program i tako uklonite virus ili da preuzmite cleaner, startujete računar u Safe Modu, iz START menija odaberete opciju RUN, pronađete sačuvani fajl, dodate jednu opciju i pustite da cleaner odradi posao.
Obe metode su uspešne.