'Klez' worm variant: Moderate threat

From...

By Jaikumar Vijayan

(IDG) -- A new variant of a worm that takes advantage of vulnerabilities in unpatched Microsoft's Internet Explorer and Outlook Express software is spreading in the wild, and antivirus vendors have placed its threat to a category 3 (of a possible 5).

The mass-mailing Win32.Klez.H@mm worm is a variant of the "Klez" worm that was first reported in October. Like its predecessors, the new version propagates through e-mail and attempts to copy itself through files that can be shared over a network. The worm uses random subject lines, the text within a message and attachment file names to try to get users to launch it.

Once launched, the worm copies itself to all addresses in the Windows address book and attempts to disable any antivirus software and processes that may be installed on a system.

IDG.net INFOCENTER Computerworld main page Computerworld's topic-oriented communities Computerworld's IT career center Free daily newsletters Visit an IDG site Choose a site: IDG.net CIO Computerworld Darwin Dummies.com GamePro.com The Industry Standard ITWorld.com InfoWorld.com JavaWorld LinuxWorld Macworld Online Network World Fusion PC World Publish.com UnixInsider IDG.net search

When the Klez.H attachment is opened, it also will often drop a copy of a virus called W32.Elkern, which infects files that can be shared over a network and mapped drives and can cause systems to crash if activated.

What's new with Klez.H is its apparent ability to spread more widely, said Sharon Ruckman, director of Symantec's security response team.

The subject lines and message bodies, for instance, have been expanded and made even more random than previous versions, she said. The virus also seems to have been designed to stop or disable a greater range of antivirus tools than older versions. In addition, the Elkern virus it carries has been modified to do more damage, Ruckman said.

Companies that are currently patched with the latest antivirus software should be protected against the virus, she said. Symantec is rating the virus as a "medium" risk.