W32.Scold@mm

W32.Scold@mm is a mass-mailing worm that uses Microsoft Outlook to send itself to contacts in the Outlook address book.

When W32.Scold@mm runs, it displays a picture of a baby seal. See the "Technical Details" section for an illustration.

The worm is written in Microsoft Visual Basic, version 6.0, and is packed with UPX.

The email has the following characteristics:

Subject: (one of the following)

• When It's Cold Outside She Gives Me Warm Inside <blank spaces and random characters>
• Fw: When It's Cold Outside She Gives Me Warm Inside <blank spaces and random characters>
• Re: When It's Cold Outside She Gives Me Warm Inside <blank spaces and random characters>

Message: (one of the following)

• You will love this cute picture.
• Enjoy this great picture.
• Don't miss this cool picture.

Attachment: <random characters>.scr

Protection

• Initial Rapid Release version December 11, 2003
• Latest Rapid Release version August 2, 2008 revision 020
• Initial Daily Certified version December 11, 2003
• Latest Daily Certified version January 20, 2009 revision 048
• Initial Weekly Certified release date December 17, 2003

Click here for a more detailed description of Rapid Release and Daily Certified virus definitions.

Threat Assessment

Wild

• Wild Level: Low
• Number of Infections: 0 - 49
• Number of Sites: 0 - 2
• Geographical Distribution: Low
• Threat Containment: Easy
• Removal: Easy

Damage

• Damage Level: Low

Distribution

• Distribution Level: High