W32/Caric-A

[Paul Wilders]

Name: W32/Caric-A
Aliases: W32.Caric@mm, W32/MyLife.b@MM
Type: Win32 worm
Date: 22 March 2002

Sophos has received several reports of this worm from the wild.

Description:

W32/Caric-A is a worm which arrives in an email with the
following characteristics:

Subject line: bill caricature
Attached file: cari.scr
Message text:

Hiiiii
How are youuuuuuuu?
look to bill caricature it's vvvery verrrry ffffunny :-) :-)
i promise you will love it? ok
buy

========No Viruse Found========
MCAFEE.COM

If you run the attachment and Outlook is installed, then
W32/Caric-A will send itself to the addresses in your address book. The worm also displays a cartoon of a man wearing a "Bill" badge and playing a saxophone.

The worm saves a copy of itself in the Windows system folder and adds the following value to the registry:

HKEY_CURRENT_USER\Software\Microsoft\Windows\
CurrentVersion\Run\win = "C:\Windows\System\cari.scr"

Read the analysis at
www.sophos.com/virusinfo/analyses/w32carica.html