Description:
Similar to its other variants, this memory-resident, multithreaded Internet worm propagates through email using its own Simple Mail Transfer Protocol (SMTP) engine. The email arrives in the following format:
Subject: don't be late! <8 random characters>
Message Body:
Will meet tonight as we agreed, because on Wednesday I don't think I'll make it,
so don't be late. And yes, by the way here is the file you asked for.
It's all written there. See you.
Attachment: readnow.zip (readnow.doc.scr)
<8 random characters>
This malware performs a denial of service (DoS) attack against the following Web sites.
This malware is packed using UPX program, and runs on Windows 95, 98, ME, NT, 2000 and XP.
I guess that narrows the list of possible culprits down to about a million or so.