A variant of the Klez worm which resurfaced earlier this week has begun to spread extremely quickly, with the UK as its top target, according to an antivirus firm.

UK-based MessageLabs said the Klez.H worm, which spreads via e-mail, proliferated "dramatically" during the day on Friday. E-mail security firm MessageLabs first detected the new variant on Monday, coming from an Internet address in China.

Klez.H, as it is called by most antivirus vendors, is a modified version of a worm that has been around for months. With the new version the code has been changed enough that it can slip past antivirus software. However, most antivirus vendors, including Symantec, McAfee and Sophos, have offered Klez.H patches since Wednesday.

MessageLabs said it stopped two copies of Klez variants on Monday. From Wednesday afternoon the number of copies rose sharply, and gathered pace on Friday. The firm said it stopped several thousand copies on Friday, for a total of more than 46,000 copies by Friday afternoon, nearly one in every 77 emails.

[an error occurred while processing this directive]

The UK topped its list with more than 5,000 copies stopped, followed by Hong Kong and the U.S.

Different variants of the Klez worm have generally been among the top three antivirus threats since the first version of the worm was released in January. The Klez.e variant, which appeared last February, was particularly voracious, quickly becoming one of the fastest-spreading worms on the Internet.

Security-software maker Symantec upgraded the latest variant, which it labelled W32.Klez.H, to a threat level of three from a previous rating of two. The company categorises threats on a scale of one, the lowest threat, to five.

The worm arrives in an e-mail message with one of 120 possible subject lines. There are 18 different standard subject headings, including "let's be friends", "meeting notice", "some questions", and "honey". On top of those, seven other patterns exist, such as "a x game" and "a x patch", where x can be one of 16 different words, including "new", "WinXP", and the name of any of six major antivirus companies.

In many circumstances, the worm doesn't need the victim to open it in order to run. Instead, it takes advantage of a 12-month-old vulnerability in Microsoft Outlook, known as the Automatic Execution of Embedded MIME Type bug, to open itself automatically on unpatched versions of Outlook.

The malicious program will find any network storage available on the infected PC and copy itself to the remote disk drives using a random file name and a .EXE, .PIF, .COM, .BAT, .SCR or .RAR extension. Occasionally, the file name will include a double extension.

The program will also cull e-mail addresses by searching a host of different file types on the infected PC. Using its own mail program, the worm will send itself off to those e-mail addresses. In addition, it will use the addresses to create a fake "From:" field in the e-mail message, disguising the actual source of the e-mail.

Finally, the worm attempts to disable antivirus software by deleting registry keys, stopping running processes and removing virus-definition files.

The worm also sports a message in its code from the author, who brags that it only took three weeks to create the malicious program.

The author claims the virus originated in Asia and may have bugs because of how fast he created it.

What are your thoughts on the recurring Klez worm? TalkBack below or e-mail us with your comments.

CNET News.com's Robert Lemos contributed to this report.

[an error occurred while processing this directive]

[an error occurred while processing this directive]