W32.Heovin@mm is a mass-mailing worm that uses Microsoft Outlook to send itself to all contacts in Windows Address Book. It attempts to send a copy of itself to other mIRC users. It also has backdoor capabilities that allows a hacker to remotely control an infected computer. The email message has the following characteristics:
The subject line is one of the following,
Subject: Flash funny pic
or
Subject: Check This update
Message: Check dis out!
Attachment: Funnyflush.pif
This threat is written in the Microsoft Visual Basic programming language.
NOTE: Definitions dated earlier than December 9, 2002, may detect this threat as Bloodhound.W32.VBWORM.
Type: Worm
Infection Length: 118,784 bytes
Systems Affected: Windows 95, Windows 98, Windows NT, Windows 2000, Windows XP, Windows Me
Systems Not Affected: Macintosh, OS/2, Unix, Linux