W32.NewApt.Worm

W32.NewApt.Worm is a multithreaded worm that propagates by email. The subject of the email is "Just for your eyes." The worm has its own SMTP (email) engine to email itself. The worm searches various files on the hard disk to find email address to which it sends itself.

Protection

• Initial Rapid Release version December 14, 1999
• Latest Rapid Release version August 20, 2008 revision 017
• Initial Daily Certified version December 14, 1999
• Latest Daily Certified version August 20, 2008 revision 016
• Initial Weekly Certified release date December 14, 1999

Click here for a more detailed description of Rapid Release and Daily Certified virus definitions.

Threat Assessment

Wild

• Wild Level: Low
• Number of Infections: 1000+
• Number of Sites: 10+
• Geographical Distribution: High
• Threat Containment: Moderate
• Removal: Moderate

Damage

• Damage Level: Low
• Payload Trigger: December 25, 1999
• Payload: Attempts to make a connection to a corporate web site.
• Large Scale E-mailing: The worm attempts to email itself to others by using addresses found within MS Mail, MS Outlook, Netscape Navigator, and other Internet-related programs.

Distribution

• Distribution Level: High
• Subject of Email: Just for your eyes
• Name of Attachment: The name of the attached file can vary. Some of hte known file names are: g-zilla.exe, cooler3.exe, cooler1.exe, copier.exe, video.exe, pirate.exe, goal1.exe, hog.exe, party.exe, saddam.exe, monica.exe, boss.exe, farter.exe, cheeseburst.exe, panther.exe,
• Size of Attachment: 69,632 bytes
• Target of Infection: System registry