|
W32.Klez.gen@mm is a mass-mailing worm that searches
the Windows address book for email addresses and sends messages
to all recipients that it finds. The worm uses its own SMTP engine
to send the messages.
The subject and attachment name of incoming emails is randomly
chosen. The attachment will have one of the following extensions:
.bat, .exe, .pif or .scr.
The worm exploits a vulnerability in Microsoft Outlook and Outlook
Express in an attempt to execute itself when you open or even
preview the message. Information and a patch for the vulnerability
can be found at
http://www.microsoft.com/technet/security/bulletin/MS01-020.asp.
W32.Klez.gen@mm attempts to copy itself to all network shared
drives that it finds.
Depending on which variant of the worm, the worm will drop one
of the following viruses:
W32.Elkern.3326,
W32.Elkern.3587
or W32.Elkern.4926
which will infect the system.
Recommendations
Symantec Security Response encourages all users and administrators
to adhere to the following basic security "best practices":
- Turn off and remove unneeded services. By default, many operating
systems install auxiliary services that are not critical, such
as an FTP client, telnet, and a Web server. These services are
avenues of attack. If they are removed, blended threats have
less avenues of attack and you have fewer services to maintain
through patch updates.
- If a blended
threat exploits one or more network services, disable, or
block access to, those services until a patch is applied.
- Always keep your patch levels up-to-date, especially on computers
that host public services and are accessible through the firewall,
such as HTTP, FTP, mail, and DNS services.
- Enforce a password policy. Complex passwords make it difficult
to crack password files on compromised computers. This helps
to prevent or limit damage when a computer is compromised.
- Configure your email server to block or remove email that
contains file attachments that are commonly used to spread viruses,
such as .vbs, .bat, .exe, .pif and .scr files.
- Isolate infected computers quickly to prevent further compromising
your organization. Perform a forensic analysis and restore the
computers using trusted media.
- Train employees not to open attachments unless they are expecting
them. Also, do not execute software that is downloaded from
the Internet unless it has been scanned for viruses. Simply
visiting a compromised Web site can cause infection if certain
browser vulnerabilities are not patched.
|
