Description:
This worm arrives and propagates via email. It uses its own Simple Mail Transfer Protocol (SMTP), which enables it to send email messages without using other email applications, such as Microsoft Outlook.
To propagate, it searches for email addresses from an infected system. It then sends email messages to the email addresses it gathers with a copy of itself as an attachment.
The email message that this worm sends may be easier to identify than those sent by most other mass-mailers. This is because, while it spoofs the From field (a common routine of mass-mailers), it uses only a set of email addresses to spoof the From field. It does not use gathered email addresses or generate addresses using common names to spoof the said field.
The email message that this worm sends has the following characteristics:
From: (any of the following)
• [email protected]
• [email protected]
• [email protected]
• [email protected]
• [email protected]
• [email protected]
• [email protected]
• [email protected]
• [email protected]
• [email protected]
• [email protected]
• [email protected]
• [email protected]
• [email protected]
• [email protected]
Subject: (any of the following)
• You have an Admirer
• Your Pic On A Website!!
• Rate My Pic.......
• Hhahahah lol!!!!
Message Body: (any of the following)
• i found this on my computer from ages ago download it and see if you can remember it
• lol i was lauging like mad when i saw it!
email me back haha...
• I was looking at a website and came across this pic they look just like you! infact im sure it is lol , did you send this pic into them ? or is it someonce else :S ? Ive Added the pic in a zip so download it and check & email me back!
• Hi ive sent 5 emails now and nobody will rate my pic!!
please download and tell me what you think out of 10 , dont worry if you dont like it just say i wont be offended p.s i was drunk when it was taken 
• Someone has asked us on there behalf to send you this email and tell you they think you are wonderfull!!! All the The mystery persons details you need are enclosed in the attachment
• please download and respond telling us if you would like to make further contact with this person. Regards Hallmark Admirer Mail Admin.
Attachment: (any of the following)
• Pic_001.exe
• Photo_01.pif
• admire_001.exe
• is_this_you.scr
• love_04.scr
• for_you.pif
• Sexy_09.scr
Users are advised not to open any email that contain the details described.
Network administrators can check for increased mail server activity and SMTP traffic.
This worm also displays the following image, which is also an indication of infection:
, Mothafuckas.
This worm arrives and propagates via email. It uses its own Simple Mail Transfer Protocol (SMTP), which enables it to send email messages without using other email applications, such as Microsoft Outlook.
To propagate, it searches for email addresses from an infected system. It then sends email messages to the email addresses it gathers with a copy of itself as an attachment.
The email message that this worm sends may be easier to identify than those sent by most other mass-mailers. This is because, while it spoofs the From field (a common routine of mass-mailers), it uses only a set of email addresses to spoof the From field. It does not use gathered email addresses or generate addresses using common names to spoof the said field.
The email message that this worm sends has the following characteristics:
From: (any of the following)
• [email protected]
• [email protected]
• [email protected]
• [email protected]
• [email protected]
• [email protected]
• [email protected]
• [email protected]
• [email protected]
• [email protected]
• [email protected]
• [email protected]
• [email protected]
• [email protected]
• [email protected]
Subject: (any of the following)
• You have an Admirer
• Your Pic On A Website!!
• Rate My Pic.......
• Hhahahah lol!!!!
Message Body: (any of the following)
• i found this on my computer from ages ago download it and see if you can remember it
• lol i was lauging like mad when i saw it!
email me back haha... • I was looking at a website and came across this pic they look just like you! infact im sure it is lol , did you send this pic into them ? or is it someonce else :S ? Ive Added the pic in a zip so download it and check & email me back!
• Hi ive sent 5 emails now and nobody will rate my pic!!
please download and tell me what you think out of 10 , dont worry if you dont like it just say i wont be offended p.s i was drunk when it was taken • Someone has asked us on there behalf to send you this email and tell you they think you are wonderfull!!! All the The mystery persons details you need are enclosed in the attachment
• please download and respond telling us if you would like to make further contact with this person. Regards Hallmark Admirer Mail Admin.
Attachment: (any of the following)
• Pic_001.exe
• Photo_01.pif
• admire_001.exe
• is_this_you.scr
• love_04.scr
• for_you.pif
• Sexy_09.scr
Users are advised not to open any email that contain the details described.
Network administrators can check for increased mail server activity and SMTP traffic.
This worm also displays the following image, which is also an indication of infection:
, Mothafuckas.