Problems Related to Variant of the W32.Klez Worm Virus Infection (326833)


The information in this article applies to:

  • Microsoft Windows XP Professional
  • Microsoft Windows XP Home Edition
This article was previously published under Q326833

SYMPTOMS

When you run Windows XP or Windows-based programs, you may experience one or more of the following symptoms:
  • Windows XP and Windows-based programs run very slowly.
  • Documents do not open properly, or when they open, they do not contain all the correct information.
  • You cannot start Windows Task Manager.

    NOTE: To start Task Manager, right-click a blank area of the taskbar, and then click Task Manager.
  • Your antivirus program no longer runs.
  • You cannot view Web sites.

CAUSE

This issue may occur if your computer is infected with a variant of the W32.Klez worm virus.

RESOLUTION

Microsoft does not provide software that can detect or remove computer viruses. If you suspect or confirm that your computer is infected with a virus, obtain current antivirus software. For a list of antivirus software manufacturers, click the following article number to see the article in the Microsoft Knowledge Base:

List of Antivirus Software Vendors

MORE INFORMATION

To determine if the W32.Klez worm virus is running on your computer:
  1. Quit all running programs.
  2. Click Start, click Run, type msconfig in the Open box, and then click OK.
  3. Click the Services tab, and then click to select the Hide All Microsoft Services check box.
  4. In the list of running services, determine if the following service is running

    WINKxxx

    where xxx is two to three random characters appended to the word WINK. For example, WINKAP, WINKZFU, or WINKNWK.
If this service is listed, your computer may be infected with a variant of the W32.Klez worm virus.

NOTE: After you remove the W32.Klez worm virus, you may have to reinstall your antivirus program.
Modification Type:MinorLast Reviewed:3/17/2005
Keywords:kbenv kbprb KB326833
©2004 Microsoft Corporation. All rights reserved.