W32.Brid.A@mm

Due to a decreased rate of submissions, Symantec Security Response has downgraded this threat from a Category 3 to a Category 2 as of May 5, 2003.

W32.Brid.A@mm is a mass-mailing worm that includes a slightly modified variant of W32.FunLove.4099. When W32.Brid.A@mm runs, it attempts to insert several files onto the system and mass-mail itself. The worm contains its own SMTP engine, and it attempts to obtain the address of the email server and contact it directly. The email message has the following characteristics:
Subject: [Registered Windows company name]
Attachment: Readme.exe

The worm uses a known exploit in Internet Explorer, Incorrect MIME Header can cause IE to Execute E-mail attachment.

NOTE: Symantec antivirus products will detect the W32.Funlove.4099 virus component with definitions that have dates of November 8, 1999, or later.




If the worm is active in memory, it may stop the processes for various security products, including Norton AntiVirus and Symantec AntiVirus. If this happens, then the process for the worm must be removed from memory before you can use your Symantec antivirus product to remove it. To do this, follow the instructions in the previous section "To remove the value that the worm added to the registry," restart the computer, and then follow the removal instructions from the beginning.