W32.Brid.A@mm

Risk Level 2: Low

Discovered:
November 4, 2002
Updated:
February 13, 2007 11:41:07 AM
Also Known As:
PE_BRID.A [Trend], W32/Braid.a@mm [McAfee], W32/Braid-A [Sophos], Win32.Braid.A [CA], I-Worm.Bridex.a [KAV], W32/Bride [Panda], W32/Bridex.A@mm [F-Prot]
Type:
Worm
Systems Affected:
Windows 2000, Windows 95, Windows 98, Windows Me, Windows NT, Windows XP
CVE References:
CVE-2001-0154

Due to a decreased rate of submissions, Symantec Security Response has downgraded this threat from a Category 3 to a Category 2 as of May 5, 2003.

W32.Brid.A@mm is a mass-mailing worm that includes a slightly modified variant of W32.FunLove.4099. When W32.Brid.A@mm runs, it attempts to insert several files onto the system and mass-mail itself. The worm contains its own SMTP engine, and it attempts to obtain the address of the email server and contact it directly. The email message has the following characteristics:
Subject: [Registered Windows company name]
Attachment: Readme.exe

The worm uses a known exploit in Internet Explorer, Incorrect MIME Header can cause IE to Execute E-mail attachment.

NOTE: Symantec antivirus products will detect the W32.Funlove.4099 virus component with definitions that have dates of November 8, 1999, or later.




If the worm is active in memory, it may stop the processes for various security products, including Norton AntiVirus and Symantec AntiVirus. If this happens, then the process for the worm must be removed from memory before you can use your Symantec antivirus product to remove it. To do this, follow the instructions in the previous section "To remove the value that the worm added to the registry," restart the computer, and then follow the removal instructions from the beginning.

Antivirus Protection Dates

  • Initial Rapid Release version November 4, 2002
  • Latest Rapid Release version September 28, 2010 revision 054
  • Initial Daily Certified version November 4, 2002
  • Latest Daily Certified version September 28, 2010 revision 036
  • Initial Weekly Certified release date November 4, 2002
Click here for a more detailed description of Rapid Release and Daily Certified virus definitions.

Threat Assessment

Wild

  • Wild Level: Low
  • Number of Infections: More than 1000
  • Number of Sites: More than 10
  • Geographical Distribution: Medium
  • Threat Containment: Easy
  • Removal: Moderate

Damage

  • Damage Level: Medium

Distribution

  • Distribution Level: High
Writeup By: Neal Hindocha

Search Threats

Search by name

Example: W32.Beagle.AG@mm
ThreatCon Widget
Internet Security Threat Report, Volume 16
Symantec DeepSight Screensaver