W32.Valha@mm

W32.Valha@mm is a mass-mailing worm that retrieves email addresses from the Microsoft Outlook Inbox, Outbox, and address book. It uses Outlook to send itself to the email addresses it finds.

The email has the following characteristics:

Subject: A very funny game for you!
Attachment: Game.<%extension%>

Subject: If you need the latest patch...
Attachment:Patch.<%extension%>

Subject: The full updater!
Attachment:Update.<%extension%>

Subject: Program installer
Attachment:Installer.<%extension%>

Subject: The setup you needed
Attachment:Setup.<%extension%>

Subject: New Program
Attachment:Program.<%extension%>

Subject: Very useful utility!
Attachment:Utility.<%extension%>

Subject: This fix a lot of problems!
Attachment:BugFix.<%extension%>

Subject: Really cool Screen Saver!
Attachment:Screen_Saver.<%extension%>

Subject: Complete guide
Attachment:Guide.<%extension%>


Where <%extension%> is one of the following:
.com
.pif
.bat
.scr
.exe

The worm also attempts to spread through file-sharing networks, as well as mIRC and ICQ.

This threat is written in the Microsoft Visual C++ programming language and is compressed with UPX.