W32.Gibe.B@mm

W32.Gibe.B@mm is a variant of W32.Gibe@mm. This mass-mailing worm uses Microsoft Outlook and its own SMTP engine to send itself to all the contacts in the Microsoft Outlook Address Book and the Windows Address Book. The email is disguised as a Microsoft Security Update and it arrives with an attachment that has a .exe or .zip file extension.

W32.Gibe.B@mm copies itself as WebLoader.exe to the startup folder of all the mapped remote drives. This worm also attempts to spread through the KaZaA file-sharing network and Internet Relay Chat (IRC). W32.Gibe.B@mm may send itself to some news groups whose URLs are carried by the worm.

This threat is written in the Microsoft Visual Basic programming language.

NOTE: Virus definitions dated on February 25, 2003 may detect this threat as W32.Gibe@mm.

Protection

• Initial Rapid Release version February 25, 2003
• Latest Rapid Release version July 19, 2008 revision 019
• Initial Daily Certified version February 25, 2003
• Latest Daily Certified version January 20, 2009 revision 048
• Initial Weekly Certified release date February 26, 2003

Click here for a more detailed description of Rapid Release and Daily Certified virus definitions.

Threat Assessment

Wild

• Wild Level: Low
• Number of Infections: 0 - 49
• Number of Sites: 3 - 9
• Geographical Distribution: Medium
• Threat Containment: Easy
• Removal: Moderate

Damage

• Damage Level: Low

Distribution

• Distribution Level: High