Threat behavior
The Win32/Elkern virus can take the following actions:
-
Copy itself to the system folder.
-
Create values in the following registry keys:
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services
These changes cause the worm process to run each time Windows starts. They also cause the worm to run as a service in the current session and each time Windows starts, so that the worm is always running regardless of whether any user is logged on.
-
Start threads periodically to copy itself to local drives and writeable network shares.
-
Infect processes by injecting itself into the process memory space.
-
Inject itself into executable files, such as files in <system folder> or %ProgramFiles%.
-
Select executable files at random and overwrite them with zeros on certain dates of the year, for example, on March 13 and September 13.
The Win32/Elkern virus is dropped by Win32/Klez. Some Win32/Elkern variants can crash if they reference an invalid memory address when running on Windows 2000, Windows XP, or Windows Server 2003.
Prevention
Take the following steps to help prevent infection on your system:
Enable a firewall on your computer
Use a third-party firewall product or turn on the Microsoft Windows XP Internet Connection Firewall.
To turn on the Internet Connection Firewall in Windows XP
-
Click Start, and click Control Panel.
-
Click Network and Internet Connections, and click Network Connections. If you do not see Network and Internet Connections, click Switch to Category View.
-
Highlight a connection that you want to help protect, and click Change settings of this connection.
-
Click Advanced, and select Protect my computer and network by limiting or preventing access to this computer from the Internet.
-
Click OK.
Get the latest computer updates
Updates help protect your computer from viruses, worms, and other threats as they are discovered. You can use the Automatic Updates feature in Microsoft Windows XP to automatically download future Microsoft security updates while your computer is on and connected to the Internet.
To turn on Automatic Updates in Windows XP
-
Click Start, and click Control Panel.
-
Click Performance and Maintenance. If you do not see Performance and Maintenance, click Switch to Category View.
-
Click System.
-
Click Automatic Updates, and select Keep my computer up to date.
-
Select a setting. Microsoft recommends selecting Automatically download the updates, and install them on the schedule that I specify and setting a regular update time.
-
If you choose to have Automatic Updates notify you in step 5, you will see a notification balloon when new downloads are available to install. Click the notification balloon to review and install updates.
Use up-to-date antivirus software
Most antivirus software can detect and prevent infection by known malicious software. You should always run antivirus software on your computer that is updated with the latest signature files to automatically help protect you from infection. If you don't have antivirus software installed, you can get it from one of several companies. For more information, see http://www.microsoft.com/athome/security/downloads/default.mspx
Use strong passwords
A strong password has at least eight characters and includes a combination of letters, numbers, and symbols. It is easy for you to remember, but difficult for others to guess. Weak passwords include any words in the dictionary, names, dates, consecutive letters or numbers, common words with symbol substitutions (for example, p@ssw0rd), and so on.
Remove unneeded network shares
Malicious software can often spread over network shares. Remove unneeded network shares that are mapped to your computer.
To remove network shares in Windows XP
-
On the Start menu, click My Computer.
-
On the Tools menu, click Disconnect Network Drives…
-
In the Disconnect Network Drives dialog box, click the drives to disconnect and click OK.
