WORM_WANOR.A

WORM_WANOR.A propagates via email using Microsoft Outlook's Messaging Application Programming Interface (MAPI). It sends an email message with itself as an attachment to all addresses listed in the Microsoft Outlook address book. The message contains the following:

Subject: SAY NOT WAR
Message body:
que caña tio

http://www.puncown.org/rvb/F15/
http://www.sundaerald.com/28224/
Attachment: Winscr.scr
​

This worm creates autorun entries certain registry entries that allow it to execute at every Windows startup. It was designed to drop copies of itself in shared folders of popular peer-to-peer file sharing applications such as eDonkey2000, Kazaa, Morpheus, Grokster, Bearshare, and ICQ. However, it fails to execute its peer-to-peer propagation routine.

If this worm has run at least 20 times, it hides the desktop icons and the Start menu. It then displays an anti-war message with the following text:

NOT WAR: NOT BLOOD FOR ...
NOT WAR, SAY NOT WAR
​

It also continuously blinks the Num Lock LED indicator.

If you would like to scan your computer for WORM_WANOR.A or thousands of other worms, viruses, Trojans and malicious code, visit HouseCall, Trend Micro's free, online virus scanner at: http://housecall.trendmicro.com/

WORM_WANOR.A is detected and cleaned by Trend Micro pattern file #489 and above.