1. Symantec/
  2. Security Response/
  3. W32.Ixas@mm


Risk Level 2: Low

February 17, 2003
February 13, 2007 11:43:12 AM
Also Known As:
WORM_IXAS.A [Trend], W32/Ixas@MM [McAfee], W32/GvoWFI.A@mm [F-Prot]
Systems Affected:

W32.Ixas@mm is a mass-mailing worm that uses its own SMTP engine to send itself to all the contacts in Windows Address Book.

The email has the following characteristics:

From: <random letters>@delfi.lt
Subject: The subject can be one of the following,
  • Gift for you
  • Urgent NEWs
  • EBAY Update
  • Antivirus Update
  • Urgent Windows UPDATE
  • Hi, look this attcahment
  • Hello, please wisit this nice site
Attachment: Attachment has a random file name with a .exe file extension.

The worm also sends itself to the email addresses it finds from the incoming emails. The email it creates for this set of email addresses has the following characteristics:

Subject: Re:
Attachment: Attachment has a random file name.
I reply as soon as possible to your email
You wrote:----------

Several variants of this threat have been found. All the variants are written in the Microsoft C++ programming language. ASPack packs some of the variants.

Antivirus Protection Dates

  • Initial Rapid Release version February 18, 2003
  • Latest Rapid Release version August 8, 2016 revision 023
  • Initial Daily Certified version February 18, 2003
  • Latest Daily Certified version August 9, 2016 revision 001
  • Initial Weekly Certified release date February 19, 2003
Click here for a more detailed description of Rapid Release and Daily Certified virus definitions.
Writeup By: Yana Liu

Search Threats

Search by name
Example: W32.Beagle.AG@mm
STAR Antimalware Protection Technologies
2016 Internet Security Threat Report, Volume 21
  • Twitter
  • Facebook
  • LinkedIn
  • Google+
  • YouTube