W32.Rexli.A@mm

W32.Rexli.A@mm is a mass-mailing worm that is written in Visual Basic. When executed, the worm emails all contacts in the Microsoft Outlook address book. If mIRC is found, the worm modifies a file called Script.ini. This modification causes an infected user to send the worm to people over the IRC network.

NOTE: This worm is detected as Bloodhound.W32.VBWORM using definitions dated prior to February 6, 2002. The IRC script that it creates in the mIRC folder is detected as IRC.Family.Gen by all definitions.



Since the modifications to the .vbs files are not viral, Norton AntiVirus will not detect these modified files.

Protection

• Initial Rapid Release version February 6, 2002
• Latest Rapid Release version August 20, 2008 revision 017
• Initial Daily Certified version February 6, 2002
• Latest Daily Certified version January 20, 2009 revision 048
• Initial Weekly Certified release date pending

Click here for a more detailed description of Rapid Release and Daily Certified virus definitions.

Threat Assessment

Wild

• Wild Level: Low
• Number of Infections: 0 - 49
• Number of Sites: 0 - 2
• Geographical Distribution: Low
• Threat Containment: Easy
• Removal: Easy

Damage

• Damage Level: Medium

Distribution

• Distribution Level: High