W32.Venzu.Worm

Discovered:
August 2, 2002
Updated:
February 13, 2007 11:55:36 AM
Type:
Worm
Systems Affected:
Windows 2000, Windows 95, Windows 98, Windows Me, Windows NT, Windows XP

W32.Venzu.Worm is a mass-mailing worm that is written in the Borland Delphi programming language and compressed with UPX. It uses SMTP to send itself to email addresses that it finds in the MSN Messenger Service list. The email message has the following characteristics,

Subject: The subject can be one of the following:
  • Los mejores chistes de Bin Laden
  • HISPASEC
  • Carnivore databases
  • Base de datos. Carnivore.
  • VAN A VENDER HOTMAIL

Attachment: The attachment can be one of the following:
  • BinLadilla.pif
  • Noticia45.Txt.pif
  • NewsHS.Txt.pif
  • CarnivoreStory.Pif
  • Estatutos.Pif

W32.Venzu.Worm also tries to spread through KaZaA, ICQ, mIRC, and floppy disk.

Antivirus Protection Dates

  • Initial Rapid Release version August 5, 2002
  • Latest Rapid Release version June 22, 2009 revision 066
  • Initial Daily Certified version August 5, 2002
  • Latest Daily Certified version June 19, 2009 revision 051
  • Initial Weekly Certified release date August 7, 2002
Click here for a more detailed description of Rapid Release and Daily Certified virus definitions.
Writeup By: Yana Liu

Search Threats

Search by name

Example: W32.Beagle.AG@mm
ThreatCon Widget
Internet Security Threat Report, Volume 16
Symantec DeepSight Screensaver