W32/APost Last Updated 9/05/01 10:34am
This worm arrives with the subject line:
As per your request!
The body of the email includes the text:
Please find attached file for your review.
I look forward to hear from you again very soon. Thank you.
The attachment is titled:
README.EXE
If the attachment is executed W32/APost copies itself to the WINDOWS directory, and then to the root of all local drives. W32/APost then ceates a registry to key run itself at startup:
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\
macrosoft=C:\WINDOWS\readme.exe
Next the worm sends itself out to every entry in the Microsoft Outlook Address Book. After sending itself out a pop up window appears:
If this Open button is pressed then the worm sends out further copies of itself and then displays an error message:
After OK is selected the worm terminates.
Do Not Open The Attachment!
This archive is not intended to be comprehensive. For a more complete virus library, please visit NAI's Virus Information Library at http://vil.nai.com.
