W32/Scold.A Worm

 Information about the W32/Scold.A Worm:

W32/Scold.A is an mass mailing worm which spreads through email. This worm will infect Windows systems. It spreads using the email addresses present in the MS-Outlook address book of the infected system.

The subject of the infected mail will be any one of the following;

When It's Cold Outside She Gives MeWarm Inside              <variable string>
Re: When It's Cold Outside She Gives MeWarm Inside        <variable string>     
Fw: When It's Cold Outside She Gives MeWarm Inside       <variable string>

The body of the infected mail will be any one of the following:

You will love this cute picture.
Enjoy this great picture.
Don´t miss this cool picture.

along with the following common message.

            ============= Free Online Virus Scan =============
                                            100% VIRUS FREE
          No viruses or suspicious files were found in the attached file.

The infected mail carries an attachment : <variable string>.scr

When the infected attachment is executed, it copies itself as Warm.scr in the Windows folder.

It alters the Windows registry at the following location to load itself during next startup;

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

After this, it tries to mail itself to all addresses found under MS-Outlook address book of the infected system.

This worm first appeared on 11th December 2003.

 Other names of W32/Scold.A Worm:

This worm is also known as W32/Scold@MM, Win32.Scold.A, W32.Scold@mm.