W32.Memas@mm

Discovered:

December 4, 2003

Updated:

February 13, 2007 12:14:43 PM

Also Known As:

Win32.Memas.A [Computer Associ, I-Worm.Memas [Kaspersky], W32/Memas@mm [McAfee], W32/Memas-A [Sophos], PE_MEMAS [Trend Micro]

Type:

Worm

Systems Affected:

Windows 2000, Windows 95, Windows 98, Windows Me, Windows NT, Windows Server 2003, Windows XP

W32.Memas@mm is a mass-mailing worm that uses Microsoft Outlook to send itself to all the contacts in the Outlook Address Book.

The email has the following characteristics:

Subject: Hi Friend
Message: Please See The Attachment
Attachment: <The worm's file name>

The worm overwrites files and makes them unusable. It may display a message, part of which is in English and the rest in Arabic.

This threat is written in the Microsoft Visual C++ programming language, with the following icon:

Antivirus Protection Dates

• Initial Rapid Release version December 5, 2003
• Latest Rapid Release version September 28, 2010 revision 054
• Initial Daily Certified version December 5, 2003
• Latest Daily Certified version September 28, 2010 revision 036
• Initial Weekly Certified release date December 10, 2003

Threat Assessment

Wild

• Wild Level: Low
• Number of Infections: 0 - 49
• Number of Sites: 0 - 2
• Geographical Distribution: Low
• Threat Containment: Easy
• Removal: Moderate