----- Original Message ----- From: "Trend Virus Info" <[log in to unmask]> To: <[log in to unmask]> Sent: Wednesday, December 11, 2002 4:04 PM Subject: Trend Micro Medium Virus Alert: WORM_WINEVAR.A Dear Trend Micro Customer: This destructive Internet worm runs on all Windows platforms. This worm propagates using its own SMTP or Simple Mail Transfer Protocol engine and sends email to addresses it gathers from HTML files on the infected system. It sends email with the following details: Subject: N`4_<Registered Organization> Message Body: <Registered Owner> - <Registered Organization> Attachments: WIN<random numeric value>.GIF (120 bytes) MUSIC_2.CEO WIN<random numeric value>.TXT (12.6 KB) MUSIC_1.HTM *<Registered Owner> is the registered owner of the machine and <Registered Organization> is the organization of the owner. This worm sends email using a known exploit that causes the attachment to automatically execute when the message is viewed or previewed on Internet Explorer-based email clients, such as Microsoft Outlook and Outlook Express. This exploit is known as Automatic Execution of Embedded MIME type. It is capable of terminating certain monitoring programs and antivirus products from memory. Upon restart, this worm deletes all files from local drives, except files that are currently running on the system. Note: This malware is detected in the Control Pattern 396 version 6, which is included in the Official Pattern 397. For more information on WORM_WINEVAR.A please visit our Web site at: http://www.trendmicro.com/vinfo/virusencyclo/default5.asp?VName=WORM_WIN EVAR.A ************************************************************************ ****************** You are receiving this email from Trend Micro, because you have either downloaded a Trend Micro product or have signed up to receive “Virus Alerts." If you would like to change the way you receive email from Trend Micro please make changes in your account page at http://www.trendmicro.com/subscriptions/default.asp?email= To UNSUBSCRIBE go to: http://www.trendmicro.com/subscriptions/default.asp?format=unsubscribe ************************************************************************ ******************* VICUG-L is the Visually Impaired Computer User Group List. To join or leave the list, send a message to [log in to unmask] In the body of the message, simply type "subscribe vicug-l" or "unsubscribe vicug-l" without the quotations. VICUG-L is archived on the World Wide Web at http://maelstrom.stjohns.edu/archives/vicug-l.html