W32.Brid.A@mm

Due to a decreased rate of submissions, Symantec Security Response has downgraded this threat from a Category 3 to a Category 2 as of May 5, 2003.

W32.Brid.A@mm is a mass-mailing worm that includes a slightly modified variant of W32.FunLove.4099. When W32.Brid.A@mm runs, it attempts to insert several files onto the system and mass-mail itself. The worm contains its own SMTP engine, and it attempts to obtain the address of the email server and contact it directly. The email message has the following characteristics:
Subject: [Registered Windows company name]
Attachment: Readme.exe

The worm uses a known exploit in Internet Explorer, Incorrect MIME Header can cause IE to Execute E-mail attachment.

NOTE: Symantec antivirus products will detect the W32.Funlove.4099 virus component with definitions that have dates of November 8, 1999, or later.




If the worm is active in memory, it may stop the processes for various security products, including Norton AntiVirus and Symantec AntiVirus. If this happens, then the process for the worm must be removed from memory before you can use your Symantec antivirus product to remove it. To do this, follow the instructions in the previous section "To remove the value that the worm added to the registry," restart the computer, and then follow the removal instructions from the beginning.

Protection

• Initial Rapid Release version November 4, 2002
• Latest Rapid Release version November 4, 2009 revision 037
• Initial Daily Certified version November 4, 2002
• Latest Daily Certified version November 4, 2009 revision 025
• Initial Weekly Certified release date November 4, 2002

Click here for a more detailed description of Rapid Release and Daily Certified virus definitions.

Threat Assessment

Wild

• Wild Level: Low
• Number of Infections: More than 1000
• Number of Sites: More than 10
• Geographical Distribution: Medium
• Threat Containment: Easy
• Removal: Moderate

Damage

• Damage Level: Medium

Distribution

• Distribution Level: High