McAfee > Theat Center > Virus Detail Page

Overview

This is a virus detection. Viruses are programs that self-replicate recursively, meaning that infected systems spread the virus to other systems, which then propagate the virus further. While many viruses contain a destructive payload, it's quite common for viruses to do nothing more than spread from one system to another.

Aliases

• I-Worm/MesMate

• TROJ_NEWAPT.WORM

• W32.NewApt.worm

• W32/NewApt.worm

Characteristics

This worm has been reported to AVERT in several countries during the week of December 13, 1999. The file may be received by email with a size of 69,632 bytes. The worm arrives by email and depending on if the email application supports HTML email body content or not, one of two messages is displayed. If HTML is supported, the message content looks like this:

---------------------------------------------------------------

---------------------------------------------------------------

If the email client does not support HTML, the email message will have this content:

---------------------------------------------------------------

he, your lame client cant read HTML, haha. click attachment to see some stunningly HOT stuff ---------------------------------------------------------------

The email contains an attachment of a randomly selected name from the following list:
baby.exe
bboy.exe
boss.exe
casper.exe
chestburst.exe
cooler1.exe
cooler3.exe
copier.exe
cupid2.exe
farter.exe
fborfw.exe
goal.exe
goal1.ex

Symptoms

Existence of this file on the local system - modifications to the system registry as mentioned above - email mailings as mentioned above.

Method of Infection

Running the executable will directly copy itself and run the mailing routine.

Removal

All Users:
Use current engine and DAT files for detection and removal.

Modifications made to the system Registry and/or INI files for the purposes of hooking system startup, will be successfully removed if cleaning with the recommended engine and DAT combination (or higher).

Additional Windows ME/XP removal considerations

Variants

Variants

N/A

All Information

Overview -

This is a virus detection. Viruses are programs that self-replicate recursively, meaning that infected systems spread the virus to other systems, which then propagate the virus further. While many viruses contain a destructive payload, it's quite common for viruses to do nothing more than spread from one system to another.

Aliases

• I-Worm/MesMate

• TROJ_NEWAPT.WORM

• W32.NewApt.worm

• W32/NewApt.worm

Characteristics

Characteristics -

This worm has been reported to AVERT in several countries during the week of December 13, 1999. The file may be received by email with a size of 69,632 bytes. The worm arrives by email and depending on if the email application supports HTML email body content or not, one of two messages is displayed. If HTML is supported, the message content looks like this:

---------------------------------------------------------------

---------------------------------------------------------------

If the email client does not support HTML, the email message will have this content:

---------------------------------------------------------------

he, your lame client cant read HTML, haha. click attachment to see some stunningly HOT stuff ---------------------------------------------------------------

The email contains an attachment of a randomly selected name from the following list:
baby.exe
bboy.exe
boss.exe
casper.exe
chestburst.exe
cooler1.exe
cooler3.exe
copier.exe
cupid2.exe
farter.exe
fborfw.exe
goal.exe
goal1.ex

Symptoms

Symptoms -

Existence of this file on the local system - modifications to the system registry as mentioned above - email mailings as mentioned above.

Method of Infection

Method of Infection -

Running the executable will directly copy itself and run the mailing routine.

Removal -

Removal -

All Users:
Use current engine and DAT files for detection and removal.

Modifications made to the system Registry and/or INI files for the purposes of hooking system startup, will be successfully removed if cleaning with the recommended engine and DAT combination (or higher).

Additional Windows ME/XP removal considerations

Variants

Variants -

N/A