Panda Software, a leading antivirus software producer, warns of the outbreak of a variation of the Klez worm, which has been assigned a threat level of 4 out of a possible 5. Like its predecessor, this new worm, W32/Klez.I, runs automatically when an infected e-mail message is opened, and carries similar damage characteristics including deleting files and preventing the victim computer from being restarted. The worm is spreading quickly over Europe and Asia, and is expected to show itself in the United States as the work-day begins and e-mail messages read. Panda has received numerous reports of this worm since its appearance several hours ago.

Klez.I arrives in a file (which could have SCR, PIF, BAT or EXE extensions) attached to an e-mail message with either of the following subjects:

• A new website
• Introduction on ADSL
• Fwd:virus,Japanese lass? sexy pictures
• A very new game
• NOSHADE CLASS

The body of the message reads as follows:

This is a new website.I wish you would like it

Or

This game is my first work.
You?re the first player.
I hope you would enjoy it.

Panda Software has updated their signature files to detect the Klez.I worm. Panda warns all users to exercise caution when viewing e-mail messages and attachments, and to update their virus signature files immediately from their website at: http://www.pandasoftware.com.

More information on W32/Klez. I is available in Panda Software?s Virus Encyclopedia at: http://www.pandasoftware.com.

Panda Software USA
Frantz Widmaier
fwidmaier@pandasecurity.com