Paul Wilders
March 22nd, 2002, 07:52 AM
Name: W32/Caric-A
Aliases: W32.Caric@mm, W32/MyLife.b@MM
Type: Win32 worm
Date: 22 March 2002
Sophos has received several reports of this worm from the wild.
Description:
W32/Caric-A is a worm which arrives in an email with the
following characteristics:
Subject line: bill caricature
Attached file: cari.scr
Message text:
Hiiiii
How are youuuuuuuu?
look to bill caricature it's vvvery verrrry ffffunny :-) :-)
i promise you will love it? ok
buy
========No Viruse Found========
MCAFEE.COM
If you run the attachment and Outlook is installed, then
W32/Caric-A will send itself to the addresses in your address book. The worm also displays a cartoon of a man wearing a "Bill" badge and playing a saxophone.
The worm saves a copy of itself in the Windows system folder and adds the following value to the registry:
HKEY_CURRENT_USER\Software\Microsoft\Windows\
CurrentVersion\Run\win = "C:\Windows\System\cari.scr"
Read the analysis at
www.sophos.com/virusinfo/analyses/w32carica.html
Aliases: W32.Caric@mm, W32/MyLife.b@MM
Type: Win32 worm
Date: 22 March 2002
Sophos has received several reports of this worm from the wild.
Description:
W32/Caric-A is a worm which arrives in an email with the
following characteristics:
Subject line: bill caricature
Attached file: cari.scr
Message text:
Hiiiii
How are youuuuuuuu?
look to bill caricature it's vvvery verrrry ffffunny :-) :-)
i promise you will love it? ok
buy
========No Viruse Found========
MCAFEE.COM
If you run the attachment and Outlook is installed, then
W32/Caric-A will send itself to the addresses in your address book. The worm also displays a cartoon of a man wearing a "Bill" badge and playing a saxophone.
The worm saves a copy of itself in the Windows system folder and adds the following value to the registry:
HKEY_CURRENT_USER\Software\Microsoft\Windows\
CurrentVersion\Run\win = "C:\Windows\System\cari.scr"
Read the analysis at
www.sophos.com/virusinfo/analyses/w32carica.html