W32.Kitro.E.Worm

W32.Kitro.E.Worm is a worm that spreads by email and over the KaZaA network. The viral email characteristics will be one of several different Subjects and Attachments. The subject may be one of the following:

• Te han enviado una postal.
• Leelo y reenvialo a quienes aprecias.
• This is the last problem.
• Para los amigos.
• Fw: Enviame tu foto.
• Es posible que nos roben el dinero!!!.
• Banks vulnerabilitie.

The corresponding attachment may be one of the following:

• Cajerosautomaticos!!!.DOC.pif
• YaNoPuedoTener$$$$$.DOC.pif
• EnNavarras.pif
• Facturas556.XLS.pif
• List.txt.by.Microsoft.com
• AuToDeTeRmInAzIon.Doc.pif
• PostalDeAmistad.pif

This worm also inserts a Visual Basic script on the computer.

Protection

• Initial Rapid Release version July 19, 2002
• Latest Rapid Release version July 19, 2002
• Initial Daily Certified version July 19, 2002
• Latest Daily Certified version July 19, 2002
• Initial Weekly Certified release date July 19, 2002

Click here for a more detailed description of Rapid Release and Daily Certified virus definitions.

Threat Assessment

Wild

• Wild Level: Low
• Number of Infections: 0 - 49
• Number of Sites: 0 - 2
• Geographical Distribution: Low
• Threat Containment: Easy
• Removal: Moderate

Damage

• Damage Level: Medium

Distribution

• Distribution Level: Medium