From Symantec's Security Response page:

W32.Klez.E@mm is similar to W32.Klez.A@mm. It is a mass-mailing email worm that also attempts to copy itself to network shares. The worm uses random subject lines, message bodies, and attachment file names.

The worm exploits a vulnerability in Microsoft Outlook and Outlook Express in an attempt to execute itself when you open or even preview the message in which it is contained. Information and a patch for the vulnerability can be found at http://www.microsoft.com/technet/security/bulletin/MS01-020.asp.

The worm overwrites files and creates hidden copies of the original. In addition, the worm drops the virus W32.Elkern.3587 which is similar to W32.ElKern.3326. The worm attempts to disable some common antivirus products and has a payload which fills files with all zeroes.

Read about it here. I've seen this going around a *lot* on my campus. It's insidious in that it appears to be a server-bounced e-mail message when it arrives. Time to get those patches...

Thanks for the heads-up. An ounce of prevention...

It's taken out a lot of computers on my campus too. It's gotten to the point where the Office of IT has been shutting down people's network connections until they get their computers fixed and verified. Of course, that's not very nice, because UMD offers free antivirus software (macafee) to students....and the method of getting it is....you guessed it, via the web.

So far, despite not being an employee for OIT, I've ended up fixing a bunch of people's computers. *sigh*. If only I got paid for this....

__________________
paul@pleaseohpleasedontspamme.slcentral.com
A mathematician is a device for turning coffee into theorems -- P. Erdos