|
Klez is a computer worm that propagates via E-mail.
It infects Microsoft Windows systems, exploiting a vulnerability in Internet Explorer, used by both Outlook and Outlook Express to render HTML mail.
The worm has a text portion and some attachments. The text portion consists of either an HTML internal frame tag, which in buggy email clients causes the worm to be executed, or a few lines of text, sometimes even claiming to be an antidote for the Klez worm.
The first attachment is the worm, whose internals vary somewhat.
Additional methods for determining a likely candidate for a "transmitter" email include the body text referring to executable attachment as a patch from Microsoft. Microsoft will never send an executable over the Internet without your specific instruction and therefore knowledge. It is bad practice for a technical support representative to send you an executable without somehow ensuring that you can't accidentally execute the code without getting in touch with him/her for further instructions.
A later variant of the worm manipulated the From address, picking a random address from the address book, hiding the true sender from the casual observer and thus making it impossible for him or her to alert the sender about the fact that his or her machine is infected.
See also
|
