| Name | W32.Chir@mm |
| Type | Worm |
| Affected | Windows 2000, Windows 95, Windows 98, Windows Me, Windows NT, Windows XP |
| Risk | Level 2: Low |
| Discovered | June 8, 2002 |
| Update | February 13, 2007 11:54:44 AM |
| Length | |
| Virus Info | W32.Chir@mm is a mass-mailing worm. It uses its own SMTP engine to send itself to email addresses. The SMTP server that the worm uses is a static one, which means that if a specific SMTP server is not running, the worm cannot spread.
The worm creates Runouce.exe (note the letter "u") in the %System% folder. Runouce.exe has the same form as the worm file that was originally received as an email attachment. The email message arrives with the following characteristics: From: <username>@hotmail.com or iloveyou@btamail.net.cn W32.Chir@mm also searches across the network and accesses files on other computers. However, due to a bug, these files are not modified in any way. If you open the message in an unpatched version of Microsoft Outlook or Outlook Express, the attachment may be executed automatically. Information about this vulnerability and a patch are available at: NOTE: Definitions dated prior to June 11, 2002 will detect this as W32.Chier@mm. |
| Threat Assessment |
Wild
Damage
Distribution
Writeup By: Cary Ng
|
| Details | >W32.Chir@mm |
convert this post to pdf.
Tags: Other, Virus, Worm
"Free Scan W32.Chir@mm
Leave a Comment
You must be logged in to post a comment.