sophos virus infoW32/Klez-H
Type
Win32 worm

Detection
Detected by Sophos Anti-Virus since March 2002.
The worm searches for email addresses in the Windows address book and also in files with the extensions TXT, HTM, HTML, WAB, ASP, DOC, RTF, XLS, JPG, CPP, C, PAS, MPG, MPEG, BAK, MP3 and PDF.

The email message "From:" field will contain either one of the addresses found in the search or an address taken from a list inside the virus body.

The worm sends itself using emails with the following characteristics:

Subject line:
The subject line is randomly created using one of the following rules.

1.
A combination of "Hi,", "Hello," "Re:", "Fw:", or nothing

with

"Very" and "special" as the first word

and

"New", "funny", "nice", "humour", "excite", "good", "powful", "WinXP" and "IE 6.0" as the second, arranged in one of the following sentences:

"A %s %s game."
"A %s %s tool."
"A %s %s website."
"A %s %s patch."

e.g. "A special powful tool"