KLEZ Alert

Date issued: 04/29/02   Updated: 05/29/02

KLEZ Summary:
Klez is one of the most widely distributed virii in some time, infecting computers around the world in one of its several variants. The KLEZ virus can infect a PC without opening an e-mail attachment. Simply clicking on an e-mail subject or previewing a message is enough to catch the virus. Klez is spread by collecting email addresses from cached files, ICQ logs and the Windows Address Book stored on an infected computer and mailing itself out using a built-in SMTP (outgoing email client) function. It can also spoof the "From:" field so a person who SEEMS infected may, in fact, simply be someone unlucky enough to have his/her address somewhere in the files of an infected computer. The only way to fully protect yourself is to ensure your Internet Explorer browser AND antivirus software are up-to-date. This can be accomplished by using the links below, or going to http://www.windowsupdate.com/ using Internet Explorer. The virus will attempt to shut down any virus scanning software before infecting your system, so you may not be alerting of an incoming virus attack. The virus has varying subject lines, and usually appears as a blank message or garbled code in Windows-based email clients such as Outlook Express, Netscape Messenger, Eudora and Outlook.

KLEZ Removal Instructions:

  1. Download the two following KLEZ removal utilities to your desktop:
    Symantec Removal Tool: ftp://ftp.uwm.edu/pub/software/Mcafee/removal_tools/klez/FixKlex.com
    Kasperski Removal Tool: ftp://ftp.uwm.edu/pub/software/Mcafee/removal_tools/klez/clrav.com
  2. Once downloaded, remove the machine from the network by unplugging the network cable. (This is to prevent further spread of the virus.)
  3. Run the the Symantec FixKlez.com removal tool.
  4. Reboot into safe mode (click here for instructions for booting into safemode in Windows 98, and here for instructions for Windows 2000) and run the Kasperski clrav.com removal tool.
  5. Delete all temporary internet files and Netscape cache.
  6. Reconnect network cable and restart into windows.
  7. Install Mcafee 4.5.1 and Service Pack 1 from web if you don't already have it. Ensure that McAfee VirusScan is updated with the most recent Scan Engine (4.1.60) and DAT version (at least 4.0.4199) Perform a full system scan, scanning all files and subdirectories.
  8. Check your Internet Explorer version number (Help/About). IF you are running IE 5.5 with SP1 or earlier, you will need to update them to IE 5.5 SP2. You can go to http://www.windowsupdate.com for this, and click on "product updates".

The direct link to the removal tools above are:
http://www.kasperski.com/news.html?tnews=20140&id=224687
http://securityresponse.symantec.com/avcenter/venc/data/w32.klez.removal.tool.html

KLEZ Behavior

Mass Emailing for Self-Propogation:
This worm searches the Windows address book, the ICQ database, and local files (including cached web pages) for email addresses. The worm sends an email message to these addresses with itself as an attachment. The worm contains its own SMTP engine and attempts to guess at available SMTP servers. For example, if the worm encounters the address user@abc123.com it will attempt to send email via the server smtp.abc123.com.

Email Spoofing:
Some variants of the Klez worm use a technique known as "spoofing." If it does this, it chooses at random an address that it finds on an infected computer as the "From:" address that it uses when it performs its mass-mailing routine. Numerous cases have been reported in which users of uninfected computers receive complaints that they have sent an infected message to someone else when indeed the supposed sender was not infected with the Klez virus. For example, John Q. Public is using a computer infected with W32.Klez.E@mm; John Q. is not using an antivirus program or does not have current virus definitions. When W32.Klez.gen@mm performs its emailing routine, it finds the email address of Harold Everyman. It inserts Harold's email address into the "From:" line of an infected email that it then sends to John Q. Public. For more information about KLEZ "spoofing" return e-mail addresses please see the following news articles:
http://www.wired.com/news/technology/0,1282,52174,00.html
http://www.wired.com/news/technology/0,1282,52055,00.html

Local and Network Drive copying:
The worm copies itself to local, mapped, and network drives as a random file name with a double extension. For example, Filename.txt.exe. A .rar archive that has a double extension. For example, Filename.txt.rar.

For more information see:
McAfee's description of KLEZ.h
NAI's description of KLEZ.e
Kasperski's description of the KLEZ family of viruses
Kasperski's description of KLEZ.h
Symantec's description of KLEZ.h
Microsoft's technical bulletin regarding the Internet Explorer security flaw

 

More KLEZ Information
(Quoted from Woody's Office Watch)


1. KLEZ ARRIVES IN FORCE
2. WHAT KLEZ DOES
3. BLAME IT INTERNET EXPLORER!
4. WHO IS SAFE?
5. WHAT TO DO - PREVENTATIVE MEDICINE
6. WHAT ABOUT OTHER BROWSERS
7. CONFUSED? SO IS MICROSOFT!
8. KLEZ CONTINUES - EMAIL ADDRESS SPOOFING

1. KLEZ ARRIVES IN FORCE
Even though it's been around since last year, the Klezfamily of email viruses have spread a lot in the last few days. The major anti-virus companies have upgraded their rating of the threat and news of this nastie has made its way into the mainstream media.

Unlike most viruses, this one does NOT need you to open an email attachment, just opening or previewing the message in Outlook or Outlook Express is enough in the right circumstances.

This isn't a theoretical virus, it's very real. Just before sending this issue of WOW we checked on of our email accounts and found two infected messages

Despite the threat against their products you won't find anything directly relevant on the Microsoft web site unless you know the code words - and even then you have to check the fineprint.

Given the situation and lack of direct information from Microsoft I got a headache trying to find out what was going on. So I delegated the whole thing to Peter Deegan who is a past master at divining glimmers of fact from behind the obfuscation that Microsoft employs.


2. WHAT KLEZ DOES
The Klez virus variants work by fooling Windows into running an email attachment as soon as you read or preview the message. That means the normal advice to avoid email attachments isn't enough.

This vulnerability has been known since at least May 2001 and the possibility of viruses spreading just by reading message long before that. As a result some of the patches from Microsoft have slowed the spread of this virus, however as events of the last few days have proved not enough computers have been protected.

Klez will spread itself to other email addresses it finds in your Windows address book, ICQ lists and files you have saved to your hard drive.

The message it generates in outgoing messages can have a variety of subject lines, body text and attachments. There's no use trying any simplistic protection method against messages with certain names or files, for you need to make sure your copy of Internet Explorer and occasionally Outlook Express is updated.


3. BLAME IT ON INTERNET EXPLORER!
While the virus is spread by email, it is neither Outlook nor Outlook Express that is to blame - it is your copy of Internet Explorer that needs fixing.

Why Internet Explorer?
Outlook and Outlook Express uses IE to display HTML formatted email messages. When you look at a HTML message in the preview pane or open message window you're actually looking at a browser window. So any vulnerability of Internet Explorer is 'inherited' by the email program.

Don't worry about what version of Outlook or Outlook Express you have - it is your browser that may need fixing.

WHICH VERSIONS OF IE
According to Microsoft only computers with these versions are vulnerable:

  • Internet Explorer 5.01 (unless you have Service Pack 2)
  • Internet Explorer 5.5

But if you look in the fine print you'll also find that Internet Explorer 6 can still be vulnerable! If you have:

  • Windows 95 (?), 98, 98SE or ME only
  • You upgraded to IE 6 using the Minimal or Custom install option (Typical is the default, either it or Full
    install protects you)

I don't know about you but I can't remember what I installed yesterday, let alone the install option I might have chosen a year or more ago! Thankfully some more digging on the Microsoft web site will reveal an answer:

The problem with the minimal or custom installs is that they don't update Outlook Express. If you think you might be in the above group them open up Outlook Express and make sure the version number starts with a 5 then you need to reinstall IE 6 with either Typical or Full options - the download page is here
http://www.microsoft.com/windows/ie/downloads/ie6/default.asp


4. WHO IS SAFE?
Windows XP users are safe (they have a complete IE6 package as part of the operating system).

Windows NT 4 and Windows 2000 users with IE 6 are also safe (there's no minimal or custom upgrade option when moving to IE 6, so Outlook Express is always updated)

Users of Internet Explorer 5.01 with Service Pack 2 (check Help | About screen) are OK.


5. WHAT TO DO - PREVENTATIVE MEDICINE
These patches are available:

Internet Explorer 5.01
http://www.microsoft.com/windows/ie/download/critical/q295106/default.asp

Internet Explorer 5.5
http://www.microsoft.com/windows/ie/download/critical/q299618/default.asp

These patches include fixes for other problems.

If you've been checking Windows Update occasionally (In IE, Tools | Windows Update) then you may be already applied these patches.

You might decide this is the time to switch to Internet Explorer 6 - it is a large download but it has been out for sometime now and is pretty stable. If you choose this route then make sure choose either the Typical or Full install options.

Naturally you should make sure your anti-virus software is up to date with the latest virus information.

If you've been infected with a Klez virus already you'll have to remove it. Both Symantec and Kaspersky have a removal tool and manual instructions for removal
http://securityresponse.symantec.com/avcenter/venc/data/w32.klez.h@mm.html
http://www.kaspersky.com/news.html?tnews=20140&id=224687


6. WHAT ABOUT OTHER BROWSERS?
You might be sitting back with a smug feeling knowing that you use Netscape, Opera or some other browser. Think again.

For starters, even if you've selected another program as your default browser, IE is still lurking on your computer and is used by Outlook and Outlook Express to display messages. So even if you don't use directly, you have to make sure IE is patched.

In the short time we've had to prepare this issue we've not been able to establish the possibility of a Netscape vulnerability. Since Netscape's Messenger email program uses the Netscape browser to display messages it is
theoretically possible. We suggest you ensure you have the latest updates for your browser as a precaution.


7. CONFUSED? SO IS MICROSOFT!
If you think all of the above is an awful mess, you're right.

You might think that an email virus that targets Microsoft's operating system / browser would be worthy of a mention to their customers. You'd be wrong.

You can be sure that many na‹ve people would turn to the Microsoft company web site for help. They only find assistance if they know (by telepathy presumably) to go an article headed 'Incorrect MIME Header can cause IE to execute e-mail attachment' is what they need. Even then that article isn't clear, doesn't mention 'Klez' or viruses - the intention is to be obscure and minimize the company's responsibility.

It would be foolish to think that checking a simple version number on the Help | About screen would be enough. Sure they could setup their software so that you could simply say 'version nn.nnnn and above is safe' - but not Microsoft.

The possible IE 6 vulnerability mentioned above wasn't revealed by Microsoft until last September and even then is just footnote in their technical details. Most people would look at the list of vulnerable products at the top (only IE 5.01 and 5.5) and not realize they could be at risk.

Even under the heading 'Does this vulnerability affect IE 6?' it commences with an empathic 'No' and then proceeds to qualify that without getting near the specific point. You have to jump to another Knowledge Base article to find what you need, like the version of Outlook Express to look for,

Even that explanation isn't consistent with other parts of the MS web site. It lists Windows 95 as potentially vulnerable but elsewhere Windows 95 is omitted because it can't support an IE 6 upgrade!

So don't worry if you get confused, it's not you, it's the tangled web of versions, upgrades, updates and patches that Microsoft has foisted on you. Be reassured and more than a little scared that even the highly paid experts at Microsoft can't get the story straight.

8. KLEZ CONTINUES
I don't know about you, but I'm drowning in bogus Klez-originated email. I get a real kick out of the versions that point you to anti-virus software manufacturers' Web sites. Chutzpah.

The Klez notices I like most are the ones generated by email scanning programs. Here's what happens. Klez infects a machine at XYZ Corporation. Klez starts doing its thing, churning out infected messages and sending them everywhere. As you probably know, Klez can "spoof" the return address - it picks up a random email address from the infected PC and makes the infected messages look like they came from the "spoofed" id. My id is on quite a few PCs, as you might imagine, and so infected messages go out all the time that appear to originate from my id.

Back at XYZ Corporation, the automatic email scanner catches the infected messages before they get sent out - which is great. The scanner reacts by sending a message to the person who's transmitting all of these bad messages. Since my id has been spoofed, the email scanner thinks that I've been sending out the messages. So the scanner sends me a message saying that I'm sending out infected messages, via the XYZ.com mail server!

Gad. It ain't my fault! Honest!

Of course, you were smart and followed our instructions last week, so you weren't infected, right? You made sure you had the latest patches for Internet Explorer, right? Er, right? If you didn't, kick yourself twice, and pull up this issue of WOW:
http://www.woodyswatch.com/office/archtemplate.asp?v7-n16

And of course you've updated your anti-virus software package's definition files. Right? Er, right?

Quoted from Woody's Office Watch. See http://www.woodyswatch.com/office/archtemplate.asp?v7-n16 for the original publication.