It appears that the newest version takes an address from an address book and hides the real source of the virus. So if you get one from someone you know, it may have come from some completly different source.

http://techupdate.zdnet.com/techupdate/stories/main/0,14179,2862410,00.html

quote:

Klez.h worm continues to spread

By Robert Vamosi

ZDNet Reviews

April 23, 2002

Another member of the Klez worm family is spreading fast across

the Internet. Klez.h (w32.klez.h@mm, also known as Klez.g and

Klez.k) is a significant variation of existing worms Klez.e and

Klez.a. Klez.h has evolved dramatically enough to be able to slip

past recent antivirus signature files on some PCs. A few users

will need to update their antivirus signature files to specifically

include Klez.h. Because of its rapid spread, Klez.h rates a 6 on

the ZDNet Virus Meter.