[atafak]

i ran a copy of KLEZ through a binary editor and extracted the following set of strings from it...if these are activated as windows commands, this little critter will do nasty things to an infected computer...

NoFileUrl


NoFolderOptions
NoChangeStartMenu


NoWindowsUpdate
NoSetActiveDesktop

NoForgetSoftwareUpdate

NoMSAppLogo5ChannelNotify


ForceCopyACLWithFile



NoResolveTrack

NoResolveSearch
NoEditingComponents
NoMovingBands


NoCloseDragDropBands



NoClosingComponents
NoDeletingComponents



NoAddingComponents

NoComponents



NoChangingWallPaper
NoHTMLWallPaper
ActiveDesktop


NoCustomizeWebView

ClassicShell



ClearRecentDocsOnExit


NoFavoritesMenu
NoActiveDesktopChanges

NoActiveDesktop
NoRecentDocsMenu



NoRecentDocsHistory
NoInternetIcon

NoSettingsWizards


NoLogoff



NoNetConnectDisconnect

NoViewContextMenu


NoTrayContextMenu


NoWebMenu


LinkResolveIgnoreLinkInfo


NoCommonGroups

EnforceShellExtensionSecurity


NoRealMode

WinOldApp


MyDocsOnNet
NoStartMenuSubFolders


NoAddPrinter



NoDeletePrinter
NoPrinterTabs


RestrictRun
NoStartBanner


NoNetHood


NoDriveTypeAutoRun

NoDriveAutoRun

NoDrives



NoFind

NoDesktop


NoSetTaskbar



NoSetFolders



NoFileMenu

NoSaveSettings

NoClose
NoRun

[anymouse]

Atafak, thanks for the confirmation of 'Klez' virus creation rather than deletion.

diotima, hopefully NAV can save most of your data and wipe this filth from your machine.