Virus warning: Klez - up there with the worst

NEWS The resurgent Klez worm is starting to run rampant, with more than 23,000 reports in the last 24 hours, according to anti-virus vendor MessageLabs. Yesterday, silicon.com reported that a new variant of the potentially damaging worm was doing the rounds. However, sightings of the H variant have surged since then. MessageLabs has now spotted over 40,000 instances of the worm in the wild since Monday. The firm estimates that currently one in every 77 emails is a copy of the virus, ranking it as one of the most damaging worms ever seen. Klez is difficult to spot because it can have one of any number of different subject lines. Mark Toshack, virus analyst for MessageLabs, said: "It looks like this just achieved critical mass last night, and today has gone pretty crazy. However, because everything - the subject line, the name of the attachment and body text - is all random, it's very hard to know what to warn people against." The H variant does not destroy any files, but installs code to make sure it will launch again. On some unpatched systems it is also able to spread without victims having to open the attachment, or even the email itself. In addition, an old bug in Microsoft's Outlook software means a user can inadvertently pass the worm on merely by highlighting an infected email in the inbox. It also carries other damaging payloads such as the Elkern virus, which it drops once the attachment is executed. Toshack recommended users update their anti-virus definitions as soon as possible.