Klez virus report 5.7

Klez virus report 5.7

http://www.symantec.com/security_response/writeup.jsp?docid=2002-041714-3225-99

1.)
It has been reported that W32.Klez.H@mm may arrive in the following email message that claims to be a Symantec virus removal tool. This message is not from Symantec. Symantec neither sends unsolicited email nor distributes virus removal tools in this manner.

Attempts to disable on-access virus scanners and some previously distributed worms (such as W32.Nimda and Code Red), by stopping any active processes. The worm removes the start up registry keys, which antivirus products use. It also copy’s it self to network drives with a random double file extension.

2.)
Code Red
2001
In July, the Code Red worm infects thousands of Windows NT/2000 servers, causing $2 billion in damages (estimated)
It defaced the infected site by adding this line of text to the screen
HELLO! Welcome to http://www.worm.com! Hacked By Chinese!

3.)