-----BEGIN PGP SIGNED MESSAGE-----

===========================================================================
             AUSCERT External Security Bulletin Redistribution

                    ESB-2001.456 -- UNIRAS Alert -19/01
                    Malicious software report W32/KLEZ
                              29 October 2001

===========================================================================

        AusCERT Security Bulletin Summary
        ---------------------------------

Product:                Outlook
                        Outlook Express
                        Internet Explorer 5.01
                        Internet Explorer 5.5
Operating System:       Windows
Impact:                 Execute Arbitrary Code/Commands

Ref:                    ESB-2001.131

- --------------------------BEGIN INCLUDED TEXT--------------------

- -----BEGIN PGP SIGNED MESSAGE-----

- - -----------------------------------------------------------------------------
UNIRAS (UK Govt CERT) Alert Notice - 19/01 dated 26.10.01  Time 09:50
UNIRAS Alerts are also available from our website at www.uniras.gov.uk
- - -----------------------------------------------------------------------------

Title
=====
New Mass mailer virus/worm W32/KLEZ AKA W95/KLEZ

Detail
====== 
A new malicious mass mailer virus has been reported to UNIRAS this morning. 
The Virus comes as an  .exe attachment; the attachment names are randomly 
generated, as are the subject lines, though some of the subject lines  
being detected are listed below.  It is possible that the virus opens 
TCP/IP ports and listens for a connection from the author, detailed 
information is limited at present. Anti virus manufacturers are aware 
of the virus and are working on definition files.

This is temporarily called Klez after the translation string: wrftyvuimopasdgqhjklezxcbn, 
which is in part of the email attachment. 

Some possible subject lines are as follows:

How are you?
Can you help me?
We want peace
Where will you go?
Congratulations!!!
Don't cry
Look at the pretty
Some advice on your shortcoming
Free XXX Pictures
A free hot porn site
Why don't you reply to me?
How about have dinner with me together?
Never kiss a stranger

The Text of the message may read as follows:

I'm sorry to do so,but it's helpless to say sorry.
I want a good job,I must support my parents.
Now you have seen my technical capabilities.
How much my year-salary now? NO more than $5,500.
What do you think of this fact?
Don't call my names,I have no hostility.
Can you help me?

This new virus uses a similar exploit to the Nimda worm; 
the user only has to view the email in the preview pane to 
execute the attachment. The details of the exploit were issued 
in UNIRAS briefing number 41/01 and refer to the Microsoft 
vulnerability in Internet Explorer (ms01-020). See advice below.

    <iframe src=cid:FJAp6U58S0V5 height=0 width=0>
    </iframe>
    Content-Type: audio/x-wav;
        name=Gn.exe
    Content-Transfer-Encoding: base64
    Content-ID: <FJAp6U58S0V5>

All samples seen so far have same checksum. pkzip: d6fe398e

UNIRAS Advice
===============
Install IE 6.0 if this has not already been installed or alternatively 
install service pack 2 for Internet explorer 5.01 and 5.5. Previous versions 
of Internet Explorer are not affected (3, 4.0). 
Once any of these updates have been installed the attachment will not automatically 
execute. This does not stop a user opening the attachment and infecting 
the network.  

- - -----------------------------------------------------------------------------
For additional information or assistance, please contact the UNIRAS HELP 
Desk by telephone or Not Protectively Marked information may be sent via 
EMail to:

uniras@niscc.gov.uk
Tel: 020 7821 1330 Ext 4511
Fax: 020 7821 1686

UNIRAS material is also available from our website at www.uniras.gov.uk 
- - -----------------------------------------------------------------------------
UNIRAS wishes to acknowledge the contributions of Message Labs and NAI in preparing
this Alert. 
- - -----------------------------------------------------------------------------
This Alert contains the information released by the original author. Some of the 
information may have changed since it was released. If the vulnerability 
affects you, it may be prudent to retrieve the advisory from the canonical site 
to ensure that you receive the most current information concerning that problem.

Reference to any specific commercial product, process, or service by trade 
name, trademark manufacturer, or otherwise, does not constitute or imply 
its endorsement, recommendation, or favouring by UNIRAS.  The views and 
opinions of authors expressed within this notice shall not be used for 
advertising or product endorsement purposes.

UNIRAS shall also accept no responsibility for any errors or omissions 
contained within this alert notice. In particular, UNIRAS shall not be 
liable for any loss or damage whatsoever, arising from or in connection with 
the usage of information contained within this notice.

UNIRAS is a member of the Forum of Incident Response and Security Teams (FIRST) 
and has contacts with other international Incident Response Teams (IRTs) in 
order to foster cooperation and coordination in incident prevention, to prompt 
rapid reaction to incidents, and to promote information sharing amongst its 
members and the community at large. 
- - -----------------------------------------------------------------------------
<End of UNIRAS Alert>

- -----BEGIN PGP SIGNATURE-----
Version: PGPfreeware 7.0.3 for non-commercial use <http://www.pgp.com>

iQCVAwUBO9kqBYpao72zK539AQFcQQP/RLz9xkahLlXBnGT+DmtK7WlRYNZqowUW
oz10CgwrB/hjcgpllUM6FK/wN73B/0xDNENnx+cConI1A0ya0vg47svyeUEnAlyZ
2kAHPv8S36c/Rvj1cB2ulyHnNOxSzDXfPmTUSk3hLqRA/jy0aq8Ib1/NDPnabWUp
/qqV5ETRrHM=
=2Ysi
- -----END PGP SIGNATURE-----


- --------------------------END INCLUDED TEXT--------------------

You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.

This security bulletin is provided as a service to AusCERT's members.  As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content.  The decision to use any or all of this information is
the responsibility of each user or organisation, and should be done so in
accordance with site policies and procedures.

NOTE: This is only the original release of the security bulletin.  It may
not be updated when updates to the original are made.  If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the original authors to ensure that the information is still current.

Contact information for the authors of the original document is included
in the Security Bulletin above.  If you have any questions or need further
information, please contact them directly.

Previous advisories and external security bulletins can be retrieved from:

	http://www.auscert.org.au/Information/advisories.html

If you believe that your system has been compromised, contact AusCERT or
your representative in FIRST (Forum of Incident Response and Security
Teams).

Internet Email: auscert@auscert.org.au
Facsimile:	(07) 3365 7031
Telephone:	(07) 3365 4417 (International: +61 7 3365 4417)
		AusCERT personnel answer during Queensland business hours
		which are GMT+10:00 (AEST).
		On call after hours for emergencies.

-----BEGIN PGP SIGNATURE-----
Version: 2.6.3i
Charset: noconv
Comment: ftp://ftp.auscert.org.au/pub/auscert/AUSCERT_PGP.key

iQCVAwUBO90aOyh9+71yA2DNAQFdQwP/bXTCSM7HYWsExaXqpEzARKoPcRnqD8tU
ry4Vn9vmIDpTZ5kTrxiK1bZRv1psNcPSll/6CjMhoXAJT65jP5+sty9E2CY3731y
mqEi5s8lhzMJg/y4m85MdmOe/RWEr45KuNUNEwse3MkBWvN+xRkhBVXsNcBXlNal
0aKw2H+rUXQ=
=XzDy
-----END PGP SIGNATURE-----