----- Original Message -----
From: "Trend Virus Info" <[log in to unmask]>
To: <[log in to unmask]>
Sent: Wednesday, December 11, 2002 4:04 PM
Subject: Trend Micro Medium Virus Alert: WORM_WINEVAR.A


Dear Trend Micro Customer:
This destructive Internet worm runs on all Windows platforms. This worm
propagates using its own SMTP or Simple Mail Transfer Protocol engine
and sends email to addresses it gathers from HTML files on the infected
system. It sends email with the following details:

Subject: N`4_<Registered Organization>
Message Body: <Registered Owner> - <Registered Organization>
Attachments:
WIN<random numeric value>.GIF (120 bytes) MUSIC_2.CEO
WIN<random numeric value>.TXT (12.6 KB) MUSIC_1.HTM

*<Registered Owner> is the registered owner of the machine and
<Registered Organization> is the organization of the owner.

This worm sends email using a known exploit that causes the attachment
to automatically execute when the message is viewed or previewed on
Internet Explorer-based email clients, such as Microsoft Outlook and
Outlook Express. This exploit is known as Automatic Execution of
Embedded MIME type.

It is capable of terminating certain monitoring programs and antivirus
products from memory.

Upon restart, this worm deletes all files from local drives, except
files that are currently running on the system.


Note: This malware is detected in the Control Pattern 396 version 6,
which is included in the Official Pattern 397.

For more information on WORM_WINEVAR.A please visit our Web site at:
http://www.trendmicro.com/vinfo/virusencyclo/default5.asp?VName=WORM_WIN
EVAR.A





************************************************************************
******************
You are receiving this email from Trend Micro, because you have either
downloaded a Trend Micro product or have signed up to receive “Virus
Alerts." If you would like to change the way you receive email from
Trend Micro please make changes in your account page at
http://www.trendmicro.com/subscriptions/default.asp?email=

To UNSUBSCRIBE go to:
http://www.trendmicro.com/subscriptions/default.asp?format=unsubscribe
************************************************************************
*******************


VICUG-L is the Visually Impaired Computer User Group List.
To join or leave the list, send a message to
[log in to unmask]  In the body of the message, simply type
"subscribe vicug-l" or "unsubscribe vicug-l" without the quotations.
 VICUG-L is archived on the World Wide Web at
http://maelstrom.stjohns.edu/archives/vicug-l.html