W32.Nolor@mm

W32.Nolor@mm is a mass-mailing worm that uses its own SMTP engine to spread itself. The email will have a variable subject line and an attachment with the filename, *.Kiss.ok.exe or *.htm.

W32.Nolor@mm is also a file infector that encrypts the host file, and then prepends itself to the host file.

This threat is written in the Borland C++ programming language.

Protection

• Initial Rapid Release version April 28, 2003
• Latest Rapid Release version October 7, 2009 revision 034
• Initial Daily Certified version April 28, 2003
• Latest Daily Certified version October 12, 2009 revision 002
• Initial Weekly Certified release date April 30, 2003

Click here for a more detailed description of Rapid Release and Daily Certified virus definitions.

Threat Assessment

Wild

• Wild Level: Low
• Number of Infections: More than 1000
• Number of Sites: More than 10
• Geographical Distribution: Medium
• Threat Containment: Easy
• Removal: Moderate

Damage

• Damage Level: Low

Distribution

• Distribution Level: High