VIRUS W32/WinExt.worm

[Hans van der Genugten <genugten@xxxxxxxxxxxxx>]

This is IMO the virus!!    Hans.

Trojan Horses

W32/WinExt.worm
This is an Internet worm which can autoreply to unread email messages of
MAPI installed email clients. The autoreply message contains a brief text
which is not unique but randomly chosen from a list. The name of the
attachment is "TryIt.exe".

Below is a list of random and possible different message bodies in the
autoreply:

------------------------ "Salut [recipient name],
A+."
------------------------

------------------------
"J'ai bien reçu ton message,
je m'en occupe rapidement.
En attendant, regardes le fichier joint."
------------------------

------------------------
"Hi [recipient name],
See You Soon"
------------------------

------------------------
"I need you to get me that doc now!
[sender name]"
------------------------

------------------------
"A bientot."
------------------------

The size of the attachment is 71,680 bytes. When it is executed, it will
copy itself to the Windows\system (Win95/98) or Winnt\system32 (WinNT)
folder as "WINEXT.EXE". A file WINEXT.DAT is also created.

Running attached executable on a Windows95/98 environment will install
itself to run at next Windows startup via a "run=" key in the WIN.INI as in
"run=C:\WINDOWS\INETD.EXE".

On a WindowsNT environment it will create in the registry database the key

\HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows
run=c:\winnt\system32\winext.exe