Oslo, 17 April 2002  

Norman ASA, a world leader in the field of data security today announced that a new worm in the Klez series is reported in the wild.

The W32/Klez.G@mm is a new email worm in the Klez series. It is in many ways similar to the previous variants. The worm will, when run, start a number of concurrent threads.

These will:

• look for and terminate running antivirus programs.
• copy the worm to other machines on the LAN
• send emails with variable subject and body text.

The worm sends itself over email and copies itself to shared network drives. It also plants a new file-infecting virus, which we have preliminarily called W32/Elkern.C. This name may change.

General characteristics

Type: Worm Alias: W32/Klez.H Spreading mechanism: Email, network, file infection

Email characteristics:

Subject: Variable

Body: Variable

Attachment: Variable

Destructivity:

Low

Payload:

Removes antivirus programs

Norman Virus Control with definitions files from April 17th 2002 or later detects this worm. Users are encouraged to update their Norman Virus Control protection to the most recent version. For detailed Information about this threat visit: www.norman.com

For further information, please contact

Norman ASA, VP Marketing Bjørn A. Windfeldt, tel.+47 67 10 97 76, mob. +47 41 53 97 76