Heads Up**W32.Sowsat.B@mm
Hi Guys..
As per my usual Heads up.. only Higher risk Threats are listed here.. ie Symantec's Cat 2 or higher..
Symantec Info Page
W32.Sowsat.B@mm
This ones entry is due to its Distribution Capability.
Threat Assesment
Quote:
Wild:- Low
Damage:- Low
Distribution:- High
Wild:
Number of infections: 0 - 49
Number of sites: 0 - 2
Geographical distribution: Low
Threat containment: Easy
Removal: Moderate
Summary of Threat
Quote:
W32.Sowsat.B@mm is a mass-mailing worm that spreads by using its own SMTP engine. The email will have variable subjects and variable attachment names. The attachment should have a .exe file extension.
An email claiming to be from Symantec was spammed to a large number of individuals in an attempt to get users to download and execute this worm. Please see the Additional information section for details.
W32.Sowsat.B@mm is written in Borland Delphi and is packed with UPX.
Also Known As: I-Worm.Sowsat.f [KAV]
Variants: W32.Sowsat@mm
Type: Worm
Infection Length: 324,608 bytes
Systems Affected: Windows 2000, Windows 95, Windows 98, Windows Me, Windows NT, Windows XP (and your surprised?)
Technical Details
Quote:
Connects to its SMTP server (smtp.ig.com.br) and sends one of the following four email messages:
Message 1:
From: AVP-Team(
[email protected])
Subject: AVP-Virus-Warning
Message: New virus in "The Wild" called "W32/Cow".Spreads through e-mail and IRC.A solution is this free program.Send this message to your friends.
Thank you, AVP Team
Attachment: varies
This threat is listed on the other AV Sites as:-
McAfee This is an earlier Version 04/26/2002
Cheers