03/29/04 - W32/MyWife.a@MM

This threat bears similarities with W32/MyLife@MM and may be written by the same author. It seems that the author has attempted to implement an external SMTP engine, which is not fully utilized by the virus in many environments. The virus contains bugs that prevent it from working as design on some systems.

The virus spreads as an email attachment. Message content may be pornographic in nature. The following list is provided for content filtering purposes.

The virus body also contains the following message:

Dear User ,
This is A very High Resk Virus Alert.
This email is sent to you because one or some of your friends has been infected
with The W32.BlackWorm.A@mm Virus.
And you could be infected too. This Virus has the ability to damage the hard disk.
This Virus infects computers using many new ways :
1- it arrives as an email attachment inside of jpg pictures.
2- it infects the ip address without the victim's knowledge.
3- it infects Microsoft Word Documents using a new exploit in hex (00fxf0xf10x).

-------------------------------------------------------------------------------
Notes:
Symantec Consumer products that support Worm Blocking functionality automatically detect this threat as it attempts to spread.
Symantec Security Response has attached a removal tool to clean and prevent the infections of W32.BlackWorm.A@mm.
--------------------------------------------------------------------------------

Sincerely
Norton AntiVirus

More info on this worm:
http://vil.nai.com/vil/content/v_101135.htm

Removal Instructions

Go to the following website for removal instructions:

http://vil.nai.com/vil/content/v_101135.htm

Download Stinger to Scan for infection:
http://vil.nai.com/vil/stinger