W32.ElKern.3587

W32.ElKern.3587 is a new variant of (and it has the same functionality as) the W32.ElKern.3326 virus.

This variant is dropped by W32.Klez.E@mm.

The only major addition to this variant is a recognition algorithm to guard against infecting self-extracting .rar and .zip archives.

Symantec offers a tool to remove infections of all known variants of W32.Klez and W32.ElKern. Click here to obtain the tool. This is the easiest way to remove these threats and should be tried first.

Note on W32.Klez.gen@mm detections: W32.Klez.gen@mm is a generic detection for variants of W32.Klez. Computers that are infected with W32.Klez.gen@mm most likely have been exposed to either W32.Klez.E@mm or W32.Klez.H@mm. If your computer is detected as infected with W32.Klez.gen@mm, download and run the tool. In most case, the tool will be able to remove the infection.

Protection

• Initial Rapid Release version January 17, 2002
• Latest Rapid Release version January 17, 2002
• Initial Daily Certified version January 17, 2002
• Latest Daily Certified version January 17, 2002
• Initial Weekly Certified release date pending

Click here for a more detailed description of Rapid Release and Daily Certified virus definitions.

Threat Assessment

Wild

• Wild Level: Low
• Number of Infections: 0 - 49
• Number of Sites: 0 - 2
• Geographical Distribution: Low
• Threat Containment: Moderate
• Removal: Moderate

Damage

• Damage Level: Medium

Distribution

• Distribution Level: Low