Most important, at least one security firm reports that the newest version of this worm will sometimes share your confidential files with others. Now in its third or fourth version, the big change came when W32.Klez.H@mm (Symantec's name) was developed from W32.Klez.E@mm, which first showed up in mid-January 2002. Klez.E was a basic mass-mailing worm that could overwrite files and create hidden copies of them. According toSymantec, W32.Klez.H@mm also plants W32.Elkern.3587, a virus that is "similar to W32.ElKern.3326." 32.Klez.H@mm is capable of spreading by e-mail and network shares. It can also infect files, but it goes one step further: Not only does it e-mail a copy of itself to addresses randomly selected from the victim's address book, but it also sometimes randomly selects another file from the victim's computer and sends that as a second attachment. McAfee recently recognised the H-variant of Klez and upped the threat rating of this worm from low to medium based on the number of infections. Symantec, Trend Micro, and other antivirus vendors have also upgraded the threat of the latest variations of Klez. Fix Fortunately, although Klez is dangerous, it's relatively easy to remove. Symantec has provided a Klez-specific removal tool free of charge. Any antivirus software updated in January or early February to deal with the Klez worm variant released at the end of January 2002 will probably block this new variation. McAfee and several other antivirus vendors explicitly state that their existing virus definitions will block the latest strains of Klez. Details When a system is infected, Klez.H copies itself to \%System%\Wink.exe, which usually means it is found in C:\Windows\System or C:\Winnt\System32. The worm also inserts one or more lines of code into the registry, which activate the worm. Further, Klez.H attempts to deactivate a number of antivirus utilities by blocking their startup registry keys. Klez.H makes copies of itself on the system and any attached network computers using a random filename with a double extension. The worm then distributes itself using Microsoft Outlook with ICQ and Windows Address Book addresses. Every element of the Outlook e-mail message created by Klez is chosen randomly, including the subject line, message body, and even the attachment names. When the worm attaches a second user file to the e-mail, the file is randomly selected from those with any of 10 to 15 extensions, including word processing (such as .doc), spreadsheet (such as .xls), PDF, text, and some imaging files. Obviously, this could easily result in confidential corporate files being sent across the Internet by Klez.