i spent more time than i should have looking for a way to block the klez virus short of forking out money for a real virus program. the easy solution i came up with is to filter on this regex in the (raw) email body: <iframe src=3Dcid:\w+ height=3D0 width=3D0>

i'm almost certain this will need some tweaking to catch other klez variants, but it worked on the couple of messages i had hanging around.