Klez.H Virus Warning

March 11, 2003

Over the past couple of days I've been bombarded with emails containing the Klez worm. These emails show return addresses from both friends and people I never heard of. These people didn't send the emails; the Klez virus scans address books both for people to send the virus to, and also for return addresses and generates the emails itself. The emails contain a couple of attachments claiming to be something that might interest you and try to coax you into executing it. One of the latest tricks is to claim that the attachment is a utility that provides Klez immunity by mimicking the worm. It then claims that your virus checker may think it is the worm, but ignore the warning and run it anyway. This is a lie; the attachment is really the Klez.H virus and will infect your computer if you run it. When infecting a computer, the virus modifies the registry to make sure it loads first. It then scans your address book looking for other computers to infect. Symptoms of an infected computer are very poor response times. The virus uses almost all the system resources for itself, leaving none for the user.

This is one of the emails I received:

subject: Worm Klez.E immunity

Klez.E is the most common world-wide spreading worm. It's very dangerous by corrupting your files. Because of its very smart stealth and anti-anti-virus technic,most common AV software can't detect or clean it. We developed this free immunity tool to defeat the malicious virus. You only need to run this tool once,and then Klez will never come into your PC. NOTE: Because this tool acts as a fake Klez to fool the real worm,some AV monitor maybe cry when you run it. If so,Ignore the warning,and select 'continue'. If you have any question,please mail to me.

See these links for more information and REAL utilities to detect and clean the Klez worm:


G.W. Deer Mouse Ranch home page