W32.Campurf@mm

W32.Campurf@mm is a mass-mailing worm that uses Microsoft Outlook to send itself to all the contacts in the Outlook Address Book. The worm terminates some antivirus and firewall processes and attempts to delete files associated with the registry. The email has the following characteristics:

Subject: Some One Looking for you!
Message: How to get a money in one days bussiness? The answer is inside the attachment.
Attachment: Fc.exe

The threat is written the Microsoft Visual Basic programming language and is compressed with UPX.

Protection

• Initial Rapid Release version January 3, 2003
• Latest Rapid Release version July 12, 2008 revision 018
• Initial Daily Certified version January 3, 2003
• Latest Daily Certified version July 12, 2008 revision 019
• Initial Weekly Certified release date January 4, 2003

Click here for a more detailed description of Rapid Release and Daily Certified virus definitions.

Threat Assessment

Wild

• Wild Level: Low
• Number of Infections: 0 - 49
• Number of Sites: 0 - 2
• Geographical Distribution: Low
• Threat Containment: Easy
• Removal: Moderate

Damage

• Damage Level: Medium

Distribution

• Distribution Level: High