View source for Klez

{{Short description|2001 computer worm}}
{{otheruses|KLEZ (disambiguation)}}
{{Infobox malware
| common_name           = Klez
| image                 = 
| caption               = 
| image2                = 
| caption2              =
| technical_name        = 
| Aliases               = 
| Type                  = [[Computer worm]]
| subtype               = 
| classification        = 
| family                = 
| isolation_date        = 
| Origin                = China, 2001
| Author                = 
<!-- Cyberattack -->
| Date                  = 
| Location              = 
| Theme                 = 
| Target                = 
| outcome               = 
| losses                = 
| suspect               = 
| convicted             = 
| sentence              = 
<!-- Technical -->
| version               = <!-- or variant -->
| OS                    = [[Microsoft Windows]]
| package               = 
| filename              = 
| filetype              = 
| filesize              = 
| exploit               = 
| ports_used            = 
| language              = 
| discontinuation_date  = 

| version1              = <!-- or variant1 -- Can be repeated up to 5 times by changing the number-->
| OS1                   = <!--Can be repeated up to 5 times by changing the number-->
| package1              = <!--Can be repeated up to 5 times by changing the number-->
| filename1             = <!--Can be repeated up to 5 times by changing the number-->
| filetype1             = <!--Can be repeated up to 5 times by changing the number-->
| filesize1             = <!--Can be repeated up to 5 times by changing the number-->
| exploit1              = <!--Can be repeated up to 5 times by changing the number-->
| ports_used1           = <!--Can be repeated up to 5 times by changing the number-->
| language1             = <!--Can be repeated up to 5 times by changing the number-->
| discontinuation_date1 = <!--Can be repeated up to 5 times by changing the number-->
}}
'''Klez''' is a [[computer worm]] that propagates via [[e-mail]].<ref name=":0">{{Cite web |title=What is the KLEZ virus? – GMS |url=https://www.gordano.com/knowledge-base/what-is-the-klez-virus/ |access-date=2024-04-30 |language=en-GB}}</ref> It first appeared in October 2001 and was originated in [[China]].<ref name=":1">{{Cite web |title=Worm:W32/Klez {{!}} F-Secure Labs |url=https://www.f-secure.com/v-descs/klez.shtml |access-date=2024-04-30 |website=www.f-secure.com |language=en}}</ref> A number of variants of the worm exist.

The virus (Klez) itself is a [[Windows PE]] [[EXE]] file of about 65[[Kilobyte|KB]], and it operates on [[WIN32]] platforms.<ref name=":0" /><ref name=":1" /> 

Klez infects [[Microsoft Windows]] systems, exploiting a vulnerability in [[Internet Explorer]]'s [[Trident (layout engine)|Trident]] layout engine, used by both [[Microsoft Office Outlook|Microsoft Outlook]] and [[Outlook Express]] to render [[HTML]] mail.

The e-mail through which the worm spreads always includes a text portion and one or more attachments. The text portion consists of either an HTML internal frame tag which causes buggy e-mail clients to automatically execute the worm, or a few lines of text that attempt to induce the recipient to execute the worm by opening the attachment (sometimes by claiming that the attachment is a patch from Microsoft; sometimes by claiming that the attachment is an antidote for the Klez worm).  The first attachment is always the worm, whose internals vary.

Once the worm is executed, either automatically by the buggy HTML engine or manually by a user, it searches for addresses to send itself to. When it sends itself out, it may attach a file from the infected machine, leading to possible privacy breaches.

Later variants of the worm would use a false ''From'' address, picking an e-mail address at random from the infected machine's Outlook or Outlook Express address book, making it impossible for casual observers to determine which machine is infected, and making it difficult for experts to determine anything more than the infected machine's Internet Service Provider.
==See also==
* [[Timeline of computer viruses and worms]]
* [[Computer viruses]]

==References==
{{Reflist}}

==External links==
* [http://www.f-secure.com/v-descs/klez.shtml Anti-virus provider F-Secure Klez information]
* [https://web.archive.org/web/20020624011701/http://www.trendmicro.com/vinfo/virusencyclo/default5.asp?VName=WORM_KLEZ.H Anti-virus provider Trend Micro Klez information]
* [https://web.archive.org/web/20060818232920/http://www.symantec.com/security_response/writeup.jsp?docid=2002-041714-3225-99&tabid=2 Anti-virus provider Symantec Klez information]
* [https://www.auscert.org.au/render.html?it=1566 AUSCERT External Security Bulletin, ESB-2001.456, "Malicious software report W32/KLEZ", 29 October 2001]. {{Archive url|url=https://web.archive.org/web/20060820232422/https://www.auscert.org.au/render.html?it=1566|date=2006-08-20}}

{{DEFAULTSORT:Klez (Computer Worm)}}

{{Hacking in the 2000s}}

[[Category:Email worms]]
[[Category:Hacking in the 2000s]]
[[Category:2001 in computing]]