W95/Apost.A@mm

Name: W95/Apost.A@mm
Aliases: Apost, W32.Urgent.Worm@mm, W32/Apost@MM, W32/Apost-A, W32/Apost.A, TROJ_APOST.A
Type: Internet Worm

Description:

W95/Apost.A@mm is a mass mailing internet worm written in Visual Basic. It arrives as an attachment to an email that contains the following information:

Subject: As per your request!
Message: Please find attached file for your review.
I look forward to hear from you again very soon. Thank you.
Attachment: readme.exe

When the attachment is run, a dialog box with the caption "Urgent!" and a button entitled "Open" will be displayed.




When the "Open" button is pressed, a fake error message will appear.




The worm then creates a copy of itself in the \\Windows\ folder and creates the following registry key:

HKCU\Software\Microsoft\Windows\CurrentVersion\Run\ macrosoft=C:\Windows\readme.exe

which will load the worm each time the system is restarted. It also copies itself as "readme.exe" to the root directories of all local drives. Finally, the worm will send a copy of itself to all email addresses in Microsoft Outlook's address book.

Detection:

Command Antivirus version 4.58.3 with definition files dated 09/04/01 will detect this virus.

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .