New virus/worm adds 'insult' to computer injury!

Question

Winevar worm adds insult to injury!

Answer

This question was answered on November 29, 2002. Much of the information contained herein may have changed since posting.

A new mass-mailing e-mail worm is infecting and insulting victims.

Known as Winevar, the computer worm arrives in e-mail as an attachment that infects Windows PCs when opened and displays a dialog box pronouncing, "What a foolish thing you have done!"

This worm is no joke, however. "Winevar has several extremely dangerous payloads, which can lead to the irrecoverable loss of data," antivirus firm Kaspersky Labs said in an advisory released 11/27/02.

Be on the lookout for the following signatures in the infected messages:

Subject of email: Re: AVAR(Association of Anti-Virus Asia Reseachers) or N`4?[registered organisation or "Trand Microsoft Inc."]

Size of attachment: 91089 bytes (.ceo and .pif) 609 bytes (.htm)

W32.HLLW.Winevar arrives in an email that contains three attachments. The names are variable but they will have the format:

Win<several characters>.Txt (12.6 KB) Music_1.htm

Win<several characters>.Gif (120 Bytes) Music_2.ceo

Win<several characters>.pif

Get complete instruction on protection and removal from Symantec at:

>http://www.sarc.com/avcenter/venc/data/w32.hllw.winevar.html</b>

Author

Posted by Ken of Data Doctors on November 29, 2002