Threat Advisory: Happy New Year! Worm

In order to help users better understand the recent mass-mailing worm named W32.Mixor.Q@mm, Symantec Security Response is providing a summary of the issues as well as additional information that may be useful in helping users avoid the threat.

The first signs of the W32.Mixor.Q worm were discovered on December 29, 2006. The worm modifies the victim's computer so that it automatically runs and downloads files from a website. The worm then attempts to spread itself by sending itself out to email addresses gathered from the infected computer. The emails sent by the W32.Mixor.Q worm typically contain some sort of New Year's greeting in the subject line. An example is "Happy New Year!" but, this may vary.

The email also contains an attachment that when opened by the recipient will also infect the recipient's computer. The most common attachment name is "postcard.exe", but other variations may exist, including "greeting card.exe" and "greeting postcard.exe". This worm will also download and execute a Trojan horse that may attempt to download and execute other malicious programs.

At this point in time, Symantec Security Response rates this worm to be of low severity.

Symantec Security Response has analyzed the threat and has provided protection for it via LiveUpdate and Intelligent Updater. The latest antivirus (AV) definitions will detect all known variants of the W32.Mixor.Q mass-mailing worm and repair related infections.