Alias:W32/Klez.gen@MM
Type:Worm 
Size:57,345 bytes 
Origin:Asia 
Date:10-26-2001 
Damage: 
VDF Version:  
Danger:High 
Distribution:Medium 

Technical DetailsThe virus W32/Klez is sent as .EXE file, spreads over Windows32-bit systems and infects .EXE files. To make sure that the resident virus remains on the memory, W32/Klez will also infect the KERNEL32.DLL.

When infecting an .EXE file, the virus adds its code at the end of this file. To detect such infected files, one looks for the string "666", which is written as code header. The virus does not infect all .EXE files/programs. The following files were not modified:

ALERTSVC.EXE, AVPM.EXE, AMON.EXE, AVP32.EXE, N32SCANW.EXE, NAVAPSVC.EXE, NOD32.EXE, NAVAPW32.EXE, NAVWNT.EXE, NAVLU32.EXE, NAVRUNR.EXE, NPSSVC.EXE, NSCHEDNT.EXE, SCAN.EXE, SMSS.EXE, _AVP32.EXE, _AVPM.EXE, NSPLUGIN.EXE.

To infect the KERNEL32.DLL, the virus saves it with the name KLEZED.TT6 and then modifies it. KERNEL32.DLL will be replaced with KLEZED.TT6 in WININIT.INI at the next system start, using a proper entry. The virus changes the address fields of the external Windows folder, so that they are included in the viral program code. In this way, the virus changes 16 KERNEL32 functions: open file, copy, delete, change properties and many more.

The virus has another dangerous damage routine in its code: on the 25th of December, the virus destroys the CMOS memory, overwrites all BIOS files of the hard disk and destroys the Flash BIOS with the same routine as CIH-virus.
Description inserted by Crony Walker on Tuesday, June 15, 2004

Back . . . .