Here is some information on Klez. <I have found the 6th of the month to be
more problematic>.
http://www.extremetech.com/article2/0,3973,372740,00.asp
Saturday the 13th will be an unlucky day for Windows users whose computers
are infected with the ubiquitous Klez worm. The most common variants of the
worm -- now the most widely distributed ever -- go on a rampage on the 13th
of every odd month (January, March, May, July, September, and November),
using a sophisticated multithreaded programming technique to scribble every
file on every disk drive from A: to Z:. (Some variants of Klez trigger on
the 6th day of each odd-numbered month and are more destructive during
certain months than in others.)
Worm Crawls In But Won't Crawl Out
Because Klez's payload is so nasty, it pays to make extra sure that your
computer is not infected. Unfortunately, even if your antivirus software has
not alerted you to the presence of the worm, it might still be there unless
you have updated your antivirus patterns religiously. Why? Because Klez is
capable of deactivating nearly all of the most popular antivirus packages...
if it gets onto the machine before the antivirus software is both installed
and updated with the latest patterns.
And from a related article:
http://www.extremetech.com/article2/0,3973,95214,00.asp
Once activated, the Klez worm gathers addresses from the user's address
book, database of e-mail messages, browser cache, and data files. It then
mails itself to those addresses, picking a bogus address from the same list
to place in the message's "From:" header. (Unless one looks at other
headers
which are hidden by Outlook, one can't tell the true origin of the message.)
Because of the false return address, the worm not only hides the identities
of infected parties (preventing others from warning them) but causes people
to accuse the wrong person when they are infected.
When Klez spreads, it will sometimes send with itself a copy of a randomly
selected data file from the infected computer. This file may contain
personal or business information that the victim would not want to be made
public. It also attempts to disable antivirus software on the victim's
machine, so that even if the victim belatedly downloads a new pattern file
it will not help.
Finally, Klez infects victims' systems with a program-infecting virus called
"Elkern." The virus does not harm data, but does encrypt and rename program
files, replacing them with a copy of itself. Each program that is run after
the machine is infected will run just once... and not thereafter.
Gaila