Content
W32/Kalel.a@MM
- Type
- Virus
- SubType
- Discovery Date
- 05/30/2005
- Length
- 101,376
- Minimum DAT
- 4502 (05/30/2005)
- Updated DAT
- 4535 (07/14/2005)
- Minimum Engine
- 5.1.00
- Description Added
- 05/30/2005
- Description Modified
- 05/31/2005 3:13 AM (PT)
Tab Navigation
Characteristics
This detection is for a mass-maiing worm. The virus arrives in an email message as follows: From:
(Spoofed email sender) Subject:
**WARNING** Mailbox Suspension Body:
Attachment:
UserPolicy.zip (uuencoded) When the attachment is run, the virus copies itself to the Windows directory. Registry keys are created to load the worm at startup:
Do not assume that the apparent sender address is an indication that the sender is infected. Additionally you may receive alert messages from a mail server saying that you are infected, which may not be the case.
This message was created automatically by mail delivery software (TMDA) - do not reply.
In order to safeguard your mailbox from unexpected termination, please read the attached document.
++ Attachment: No Virus found
++Norton AntiVirus
http://www.symantec.com
The zip file contains one of the following file names:
Installation
It also creates the following files.
Symptoms
This worm runs notepad.exe and displays the following message:
The worm runs a backdoor at tcp/4784 and a keylogger. It then terminates the following processes. 
The worm also attemps to access http://search.yahoo.com.
Method of Infection
The mailing component avoids certain address, those using the following strings: The virus sends itself via SMTP - constructing messages using its own SMTP engine. The worm guesses the recipient email server, prepending the target domain name with the following strings:
The worm also attempts to copy itself to the following P2P application shared folders.
Removal
All Users:
Use current engine and DAT files for detection and removal.
Modifications made to the system Registry and/or INI files for the purposes of hooking system startup, will be successfully removed if cleaning with the recommended engine and DAT combination (or higher).
Variants
Variants
N/A
All Information
Overview -
This is a virus detection. Viruses are programs that self-replicate recursively, meaning that infected systems spread the virus to other systems, which then propagate the virus further. While many viruses contain a destructive payload, it's quite common for viruses to do nothing more than spread from one system to another.
Characteristics
Characteristics -
This detection is for a mass-maiing worm. The virus arrives in an email message as follows: From:
(Spoofed email sender) Subject:
**WARNING** Mailbox Suspension Body:
Attachment:
UserPolicy.zip (uuencoded) When the attachment is run, the virus copies itself to the Windows directory. Registry keys are created to load the worm at startup:
Do not assume that the apparent sender address is an indication that the sender is infected. Additionally you may receive alert messages from a mail server saying that you are infected, which may not be the case.
This message was created automatically by mail delivery software (TMDA) - do not reply.
In order to safeguard your mailbox from unexpected termination, please read the attached document.
++ Attachment: No Virus found
++Norton AntiVirus
http://www.symantec.com
The zip file contains one of the following file names:
Installation
It also creates the following files.
Symptoms
Symptoms -
This worm runs notepad.exe and displays the following message:
The worm runs a backdoor at tcp/4784 and a keylogger. It then terminates the following processes.
The worm also attemps to access http://search.yahoo.com.
Method of Infection
Method of Infection -
The mailing component avoids certain address, those using the following strings: The virus sends itself via SMTP - constructing messages using its own SMTP engine. The worm guesses the recipient email server, prepending the target domain name with the following strings:
The worm also attempts to copy itself to the following P2P application shared folders.
Removal -
Removal -
All Users:
Use current engine and DAT files for detection and removal.
Modifications made to the system Registry and/or INI files for the purposes of hooking system startup, will be successfully removed if cleaning with the recommended engine and DAT combination (or higher).
Additional Windows ME/XP removal considerations
Variants
Variants -
N/A
