The Klez worm is a mass-mailing worm that exploits a vulnerability to open an executable attachment even in Microsoft Outlook's preview pane. The Klez worm gathers email addresses from the entries of

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run is a generic autorun key used by countless legitimate programs and many types of malware, so it does not uniquely identify the Klez worm.

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run is also a common autorun location shared by many applications and malware families, providing no specific identification of Klez.

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServices is another generic startup execution key and does not distinguish the Klez worm from other malware that uses autorun persistence.

The Klez worm's defining behavior is harvesting email addresses from the Windows Address Book (WAB) to fuel its mass-mailing activity. The registry value HKEY_CURRENT_USER\Software\Microsoft\WAB\WAB4\Wab File Name stores the path to the WAB file, making it the specific registry indicator that fingerprints the Klez worm's presence and email-harvesting mechanism rather than just generic persistence activity.