W32.Aplore@mm

W32.Aplore@mm is a mass-mailing worm that attempts to spread using email, IRC, and AOL Instant Messenger (AIM).

The worm sends an email that contains an attachment, Psecure20x-cgi-install.version.6.01.bin.hx.com, to all addresses that it finds in the Microsoft Outlook address book.

When connected to IRC or AIM, the worm sends a Web link to IRC channels or AIM contacts which references an .html file that was dropped on the infected computer. This file displays as a Web page, which asks the visitor to run a copy of the worm.



Definitions dated prior to April 8, 2002, may detect the Email.vbs file as Bloodhound.VBS.Worm.

• Definitions dated prior to April 9, 2002, will detect this as W32.Aphex@mm.

Protection

• Initial Rapid Release version April 8, 2002
• Latest Rapid Release version August 20, 2008 revision 017
• Initial Daily Certified version April 8, 2002
• Latest Daily Certified version August 20, 2008 revision 016
• Initial Weekly Certified release date April 10, 2002

Click here for a more detailed description of Rapid Release and Daily Certified virus definitions.

Threat Assessment

Wild

• Wild Level: Medium
• Number of Infections: 50 - 999
• Number of Sites: 3 - 9
• Geographical Distribution: Medium
• Threat Containment: Easy
• Removal: Easy

Damage

• Damage Level: Low

Distribution

• Distribution Level: High