Date Discovered: 1/28/2004
Date Added: 2/28/2004
Origin: Unknown
Length: varies
Type: Virus
SubType: Internet Worm

Virus Characteristics

This new variant has the same functionalities as the .c variant. It uses different file names to write to the local machine. The file size is different.

This is a mass-mailing worm with the following characteristics:

contains its own SMTP engine to construct outgoing messages
harvests email addresses from the victim machine
the From: address of messages is spoofed
contains a remote access component (notification is sent to hacker)
Messages are constructed as follows:

From : (address is spoofed)
Body : (Message body is empty)
Subject :

Accounts department
Ahtung!
Camila
Daily activity report
Flayers among us
Freedom for everyone
From Hair-cutter
From me
Greet the day
Hardware devices price-list
Hello my friend
Hi!
Jenny
Jessica
Looking for the report
Maria
Melissa
Monthly incomings summary
New Price-list
Price
Price list
Pricelist
Price-list
Proclivity to servitude
Registration confirmation
The account
The employee
The summary
USA government abolishes the capital punishment
Weekly activity report
Well...
You are dismissed
You really love me? he he
Attachment : randomly named binary within a .ZIP file (~16KB).


More: http://us.mcafee.com/virusInfo/default.asp?id=description&virus_k=101061