The Klez worm is a mass-mailing worm that exploits a vulnerability to open an executable attachment even in Microsoft Outlook's preview pane. The Klez worm gathers email addresses from the entries…

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run is a system-wide autorun persistence key used by many programs and malware but does not uniquely identify the Klez worm or its WAB address harvesting technique.

The registry value HKEY_CURRENT_USER\Software\Microsoft\WAB\WAB4\Wab File Name stores the file system path to the Windows Address Book (WAB) database file. The Klez worm specifically reads this registry key to locate the WAB file, then parses it to extract stored email addresses used as targets and spoofed senders for mass-mailing propagation. This key is the definitive forensic indicator linking the worm's email harvesting behavior to the WAB.

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run is a per-user autorun persistence location common to many applications and malware families, and does not specifically identify the Klez worm's WAB email harvesting mechanism.

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServices was a legacy Windows 9x/NT key for registering services at startup and has no connection to the Klez worm's WAB address book harvesting functionality.