W32.Hardoc@mm

W32.Hardoc@mm is a mass-mailing worm that sends itself to email addresses found in .html files and the Windows address book on the infected computer. This worm uses the Incorrect MIME Header vulnerability (described in Microsoft Security Bulletin MS01-020) to allow the automatic execution of the attachment on an unpatched computer.

The email has the following characteristics:

Subject: (One of the following)

• Re:
• Fw:
• Power Point

Body: !!! Power Point !!!
Attachment: PowerPoint.scr

Protection

• Initial Rapid Release version July 11, 2004
• Latest Rapid Release version July 11, 2004
• Initial Daily Certified version July 11, 2004
• Latest Daily Certified version July 11, 2004
• Initial Weekly Certified release date July 14, 2004

Click here for a more detailed description of Rapid Release and Daily Certified virus definitions.

Threat Assessment

Wild

• Wild Level: Low
• Number of Infections: 0 - 49
• Number of Sites: 0 - 2
• Geographical Distribution: Low
• Threat Containment: Easy
• Removal: Easy

Damage

• Damage Level: Low

Distribution

• Distribution Level: Low