21/9/2000 - W95/MTX-mm world spread

Name:   SABIA            W32/MTX-mm





First Detected:   1st September 2000 12:11 GMT from the UK
Number Caught:    159
Current Activity: Medium
Destructive:      Yes

September 21st

The daily catch of W32/MTX-mm up to the 21st September is as follows

September 20th

The current world spread is seen by MessageLabs is as follows (each pixel in height represents one incident):

September 7th

Two copies were intercepted today from Indonesia.

September 6th

Three copies were intercepted today from different sources in Sao Paulo, Brazil.

September 1st

This is a mass mailing worm which also includes a backdoor component which allows the infected PC to be manipulated.

The worm modifies wsock32.dll, and send emails which contain one of the following attachments:

README.TXT.pif
I_wanna_see_YOU.TXT.pif
MATRiX_Screen_Saver.SCR
LOVE_LETTER_FOR_YOU.TXT.pif
NEW_playboy_Screen_saver.SCR
BILL_GATES_PIECE.JPG.pif
TIAZINHA.JPG.pif
FEITICEIRA_NUA.JPG.pif
Geocities_Free_sites.TXT.pif
NEW_NAPSTER_site.TXT.pif
METALLICA_SONG.MP3.pif
ANTI_CIH.EXE
INTERNET_SECURITY_FORUM.DOC.pif
ALANIS_Screen_Saver.SCR
READER_DIGEST_LETTER.TXT.pif
WIN_$100_NOW.DOC.pif
IS_LINUX_GOOD_ENOUGH!.TXT.pif
QI_TEST.EXE
AVP_Updates.EXE
SEICHO-NO-IE.EXE
YOU_are_FAT!.TXT.pif
FREE_xxx_sites.TXT.pif
I_am_sorry.DOC.pif
Me_nude.AVI.pif
Sorry_about_yesterday.DOC.pif
Protect_your_credit.HTML.pif
JIMI_HMNDRIX.MP3.pif
HANSON.SCR
FUCKING_WITH_DOGS.SCR
MATRiX_2_is_OUT.SCR
zipped_files.EXE
BLINK_182.MP3.pif

The attachment is a copy of the worm.