W32.Mapson.Worm

W32.Mapson.Worm sends itself to all the contacts in the MSN messenger contact list. The Subject line, Message body, and attachment vary. The attachment will have a .com, .exe, or .pif file extension. Also, the email may have spoofed the From field.

This worm also attempts to spread itself through the KaZaA, KaZaA Lite, eDonkey2000, Gnucleus, Limewire, Morpheus, Grokster file-sharing networks and ICQ.

If the current system month is July, the worm will display messages with the title "Lorraine Worm [GEDZAC LABS 2003]."

W32.Mapson.Worm is written in the Borland Delphi programming language and is compressed with UPX.

Protection

• Initial Rapid Release version June 7, 2003
• Latest Rapid Release version August 20, 2008 revision 017
• Initial Daily Certified version June 7, 2003
• Latest Daily Certified version January 20, 2009 revision 048
• Initial Weekly Certified release date June 7, 2003

Click here for a more detailed description of Rapid Release and Daily Certified virus definitions.

Threat Assessment

Wild

• Wild Level: Medium
• Number of Infections: More than 1000
• Number of Sites: More than 10
• Geographical Distribution: Medium
• Threat Containment: Easy
• Removal: Moderate

Damage

• Damage Level: Low

Distribution

• Distribution Level: High