W32/MyWife.A Worm

 Information about the W32/MyWife.A worm:

W32/MyWife.A is an email worm. This worm will infect Windows systems and spreads through email. The worm has the capability to disable several antivirus programs.

It arrives with any one of the following subject:

very hot XXX
Video Clip
Re: Why?
Form Back.mpg
Re: Double suck (movie)
RE: FW: Women Mpeg
Fw: Virus Alert
FW: File - WebCam.mpeg
FW: **Hot Movie**
FW: (-Sucking-)
Asses Mpeg's
Alert
Fw: My Funny Ass
FW:Re:Hot Erotic
FW:RE: Least *21* Years
FW: Lesbian & gays Mpeg

The body of the mail contains any of the following;

Cum and check this fun group out...Sexy ladies!! Come post your ad,..this is a real swingers group!!

I'm attatching a Video Clip of my wife if interested in checking it out!

All kinda Women Can be Found Here To Satisfy Women Lovers' Eyes

Watch the Paris Hilton Sex Tape for Free!

Here is another Vclip of my daily group :|

very good movie >>> Video's Media Player. SEX SEX * Sluts Tits Video Mpeg's Mpeg Video Clips

Dozens of Free Video Clips to download.Many Niches. Updated regularly and more added daily.Taken From Vivi's Lovely Briefcase.

hey guys my name is April Goostree i am a sexy 22 yr old bbw , 5'9, 48 dd , big ole booty, jus lovin life, until i get my pics posted in here you can either check out my profile or join my own yahoo group Texas-Sexy@groups.msn.com, either way works for me..i hope to become very active in this group, i like to get to know people, like to get on cam once in a while, jus to chill, when they aint none home..thats why its once in a while yaknow..anyways jus holla at me... n thanks for lettin me join!!! kisses kandee..Bye

Video's Girls Erotic WebCam's Tits Mpeg's Girls Ass SEX Pussy Video Clips

Dear User ,

This is A very High Resk Virus Alert.
This email is sent to you because one or some of your friends has been infected with The W32.BlackWorm.A@mm Virus.
And you could be infected too. This Virus has the ability to damage the hard disk.
This Virus infects computers using many new ways :

1- it arrives as an email attachment inside of jpg pictures.
2- it infects the ip address without the victim's knowledge.
3- it infects Microsoft Word Documents using a new exploit in hex (00fxf0xf10x).

----------------------------------------------------------------------------------------------------------------------------
Notes:

Symantec Consumer products that support Worm Blocking functionality automatically detect this threat as it attempts to spread.
Symantec Security Response has attached a removal tool to clean and prevent the infections of W32.BlackWorm.A@mm.
----------------------------------------------------------------------------------------------------------------------------

Sincerely
Norton AntiVirus

The attachment will be any one of the following;

Sexual_Crimes.MPEG____.scr
Ricky_Gay_ass.MPEG______________.scr
Julia_1997_Fucking.MPEG_.scr
Graham_Hilton_Sex[4].MPEG__.scr
GrahamCluley_freakin_Ass_.MPEG__.scr
why_fuck_anal_back.MPEG.scr
open_girl_21year.MPEG.scr
juanita_in_the_kitchen.MPEG.scr
WebCam_12girls_Ass.mpeg_.scr
Video_briefcase_Group[13].MPEG_.scr
Shakira_Anal_very_old.MPEG.scr
April_FromTexas.MPEG_.scr
After_2AM_small_room[4].MPEG__.scr
17Ag_double_suck__part[2].MPEG_.scr

Upon execution of the attachment, the worm drops ossmtp.dll and oswinsck.dll in the Windows System folder. The worm also copies itself as <Random file name> with a .exe extension in Windows folder and Windows Systrem folder.

It also makes necessary modifications to registry at the following locations to load itself at next system startup;

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion \Run

The worm spreads by mailing itself to the addresses present in .htm and .dbx files and contact list present in Yahoo and MSN Messenger of the infected system.

It uses its own SMTP engine to mail itself to those addresses.

This worm first appeared on 23rd March 2004.

 Other names of W32/MyWife.A worm:

This worm is also known as W32/MyWife.a@mm,W32.Blackmal@mm, I-Worm.Nyxem, W32/Blackworm.A@mm, WORM_BLUEWORM.A.

Download the FREE Evaluation copy of Protector Plus antivirus software