W32/Melare Worm

 Information about the W32/Melare worm:

W32/Melare is an email worm. This worm will infect Windows systems. It spreads using the email addresses present in Microsoft Outlook address book.

The infected mail's subject, message body and the infected attachment will be:

Subject: Alert! SARS Is being Spread
Message body: Hi!, This is a beta test SARS. Please check an attachment!
Attachment: sars_image.jpg

Clicking on the attachment executes a script, which runs an executable file called a.exe. The worm copies itself as csrss.EXE to Windows folder. It modifies registry at the following location to run itself at the startup.

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run

The worm tries to collect all the email addresses found under Micrsoft Outlook address book and tries to mail itself to these email addresses. The worm has a payload on spcified dates of the month, which deletes *.OCX and *.DLL files present under Windows folder.

This worm first appeared on 17th May 2003.

 Other names of W32/Melare worm:

This worm is also known as W32/Melare@MM, Melare, I-Worm.Melare