W32.Naco.D@mm is a variant of W32.Naco@mm.
W32.Naco.D@mm is a mass-mailing worm that attempts to spread itself by email and file-sharing networks. The worm also contains a Backdoor functionality and attempts to replace HTML files on the Microsoft IIS server.
This variant, unlike previous variants, can also infect files. The code for W32.Naco.D@mm is buggy, and therefore, may infect the same files multiple times.
W32.Naco.D@mm is written in the Microsoft Visual Basic (VB) programming language and has been compiled to P-Code. Thus, The VB run-time libraries are required to execute W32.Naco.D@mm.
The worm has been packed and obfuscated using a known run-time compression utility, which appears to be an attempt to make it more difficult to analyze the threat.
When W32.Naco.D@mm is executed, it will attempt to display two messages with the titles:
Click for a more detailed description of Rapid Release and Daily Certified virus definitions.