Malware type: Worm

Aliases: Email-Worm.Win32.Klez.k (Kaspersky), Generic.dx (McAfee), W32.Klez.E@mm (Symantec), Worm/Klez.E.1 (Avira), Mal/Packer (Sophos), Worm:Win32/Klez.E@mm (Microsoft)

In the wild: Yes

Destructive: Yes

Language: English

Platform: Windows 95, 98, 2000, NT, ME, XP

Encrypted: Yes

Description: 
This destructive mass-mailing worm propagates copies of itself across network drives. Upon execution, it drops two executable files, WINK*.EXE and WQK.EXE, in the Windows System folder. It also creates registry entries that allow it to run at system startup.

This worm terminates processes, and occasionally deletes files associated with certain antivirus programs. On the sixth (6) day of every odd-numbered month (January, March, May, July, September, November) it overwrites files with the following extensions:

• TXT
• HTM
• HTML
• WAB
• DOC
• XLS
• CPP
• C
• PAS
• MPEG
• MPG
• BAK
• MP3
• JPG

Read more about these variants.

For additional information about this threat, see:
Solution
Technical Details

Description created: Jan. 17, 2002 2:27:59 PM GMT -0800
Description updated: Mar. 5, 2002 4:00:00 PM GMT -0800

Search a new malware

Tell us how we did. Take our quick survey.