Technorati
Digg
Delicious
Reddit
StumbleUpon
Facebook
Yahoo
Twitter
Faves
Newsvine
- Discovered:
- June 12, 2003
- Updated:
- February 13, 2007 12:03:49 PM
- Also Known As:
- I-Worm.Fearso [KAV], W32/Nofer-A [Sophos], Win32.Fearso.C [CA], WORM_NOFER.C [Trend], W32/Fearso.C [F-Prot]
- Type:
- Worm
- Systems Affected:
- Windows 2000, Windows 95, Windows 98, Windows Me, Windows NT, Windows XP
W32.Nofer.A@mm is a mass-mailing worm that uses, for example, Microsoft Outlook, to send itself to all the contacts in the Outlook Address Book. The worm also attempts to spread itself through file-sharing networks, such as KaZaA, KaZaA Lite, Edonkey, Edonkey2000, Morpheus, and Grokster.
The icon of the infected file looks like a WinRAR self-extracting archive icon.
When W32.Nofer.A@mm runs, it displays the fake message, "This File is Corrupted."
This worm is written in the Borland Delphi programming language and is usually compressed with UPX.
Antivirus Protection Dates
- Initial Rapid Release version June 13, 2003
- Latest Rapid Release version March 12, 2012 revision 032
- Initial Daily Certified version June 13, 2003
- Latest Daily Certified version March 12, 2012 revision 035
- Initial Weekly Certified release date June 18, 2003
Click here for a more detailed description of Rapid Release and Daily Certified virus definitions.
Threat Assessment
Wild
- Wild Level: Low
- Number of Infections: 0 - 49
- Number of Sites: 0 - 2
- Geographical Distribution: Low
- Threat Containment: Easy
- Removal: Easy
Damage
- Damage Level: Low
Distribution
- Distribution Level: High
Writeup By: Jari Kytojoki
