Alternately known as Klez.g, Klez.h and Klez.k, depending on the security advisory that's referring to it, the worm has its own e-mail engine to mass mail itself to potential victims, and it also attempts to deactivate some antivirus products. The worm can spread to network shares as well, shared drives connected to PCs via local area networks or LANs.

While the e-mail message in which the worm gift-wraps itself is relatively standard, its ability to elude most antivirus products has enabled it to spread fairly widely, said Alex Shipp, an antivirus technologist for U.K.-based e-mail service provider MessageLabs.