W32.Rexli.A@mm

W32.Rexli.A@mm is a mass-mailing worm that is written in Visual Basic. When executed, the worm emails all contacts in the Microsoft Outlook address book. If mIRC is found, the worm modifies a file called Script.ini. This modification causes an infected user to send the worm to people over the IRC network.

NOTE: This worm is detected as Bloodhound.W32.VBWORM using definitions dated prior to February 6, 2002. The IRC script that it creates in the mIRC folder is detected as IRC.Family.Gen by all definitions.



Since the modifications to the .vbs files are not viral, Norton AntiVirus will not detect these modified files.