Virus Warning - W32/Navidad@MM.worm Last Updated 12/01/00

This worm uses MAPI to spread itself. It will arrive as an attachment in a response to a letter sent to an infected user. The attachment is:
NAVIDAD.EXE.

When the worm is run it displays a window titled: "Error" which reads "UI". In the system tray in the lower right hand corner near the clock a blue eye icon appears. A copy of the trojan is saved to the file "winsvrc.vxd" in the WINDOWS SYSTEM directory.

The worm also creates the following registry key values:

• HKEY_CURRENT_USER\SOFTWARE\Navidad
  
• HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\
  Win32BaseServiceMOD=C:\WINDOWS\SYSTEM\winsvrc.exe
  
• HKEY_CLASSES_ROOT\exefile\shell\open\command\(default)=C:\WINDOWS\SYSTEM\winsvrc.exe "%1" %*

For additional information see:

http://vil.nai.com/vil/content/v_98881.htm from NAI.

Do NOT execute email attachments!

This archive is not intended to be comprehensive. For a more complete virus library, please visit NAI's Virus Information Library at http://vil.nai.com.