Winevar worm adds insult to injury!
This question was answered on November 29, 2002. Much of the information contained herein may have changed since posting.
A new mass-mailing e-mail worm is infecting and insulting victims
Known as Winevar, the computer worm arrives in e-mail as an attachment that infects Windows PCs when opened and displays a dialog box pronouncing, "What a foolish thing you have done!"
This worm is no joke, however "Winevar has several extremely dangerous payloads, which can lead to the irrecoverable loss of data," antivirus firm Kaspersky Labs said in an advisory released 11/27/02.
Be on the lookout for the following signatures in the infected messages:
Subject of email: Re: AVAR(Association of Anti-Virus Asia Reseachers) or N`4?[registered organisation or "Trand Microsoft Inc."]
Size of attachment: 91089 bytes (.ceo and .pif) 609 bytes (.htm)
W32.HLLW.Winevar arrives in an email that contains three attachments The names are variable but they will have the format:
Win<several characters>.Txt (12.6 KB) Music_1.htm
Win<several characters>.Gif (120 Bytes) Music_2.ceo
Get complete instruction on protection and removal from Symantec at:
About the author
Posted by Ken Colburn of Data Doctors on November 29, 2002