Any can be vulnerable if . . .
. . you open the mail. Only Outlook will propegate the virus by email, but once it's running it goes for network drives. Anything accessable to Windows cllients is vulnerable. The worst infection I've seen was at a client that uses Microsoft Exchange Server intensively - only 2 of his 20 computers had less than 150 infected files.
At a client who does not use Outlook (not since SirCam emailed his customer list to all his competitors), some machines escaped infection. Three other clients who also use PMMail were 100% infected.
Klez.H has a long list of email tricks to get you to open it. My favorite is the one disguised as an undelivered mail notice. Who can resist opening the message to see why their mail wasn't delivered? A more obvious one is the one that warns about Klez.E.
One client receives many real bounced email notices from virus filtering services because someone who is infected had his address in their Outlook address book. Klez.H uses forged return addresses to hide the identity of infected machines.
Most of the infections are actually Elkern.C, which Klez.H brings with it - only a few are actually Klez.H. Elkern.C infects mainly Microsoft Office subdirectories in \\Program Files. I haven't seen a definitive analysis of Elkern.C, but previous Elkern versions are said to destroy all files on hard disks on March 13th and September 13th.
The worst infected machine I've seen had over 450 files infected, but about 33 and 95 and 165 files are common infection points. The one with 450 infections had to be reformatted, as did several machines that had multiple viruses, but most infected machines recover well.
