Hybrid Klez worm updates itself
Source: ZDNet
A new version of a minor worm is spreading via e-mail and shared files on networks. Klez.E (w32.klez.e@mm) is sometimes called the Twin Virus because the worm is used to spread an upgraded version of the ElKern virus (w32.elkern.b). The new version can now infect Windows 98, Me, 2000, and XP, attempting to corrupt files on these systems without changing their sizes. Fortunately, Klez.E is not considered a high risk by antivirus software vendors and currently ranks 4 on the ZDNet Virus Meter.
Klez.E arrives by e-mail or can be spread by sharing infected files on a network. If it arrives by e-mail, the subject line is randomly chosen from the following list:
How are you
Let's be friends
Darling
Don't drink too much
Your password
Honey
Some questions
Please try again
Welcome to my hometown
the Garden of Eden
introduction on ADSL
Meeting notice
Questionnaire
Congratulations
Sos!
japanese girl VS playboy
Look,my beautiful girl friend
Eager to see you
Spice girls' vocal concert
Japanese lass' sexy pictures
The body text may be blank. The attached filename itself is random with either a PIF, SCR, EXE, or BAT extension.
