W32.AJM.Worm

W32.AJM.Worm is a mass-mailing worm. It uses Microsoft Outlook to send itself to email addresses that it retrieves from all unread email messages. The subject line and message body of the email are written in Korean. The attachment file name may also contain Korean characters. The following are some attachment names:

• Heddink.exe
• Go Korea.exe
• RedDevil.exe
• WorldCup.exe
• 2002.exe

Protection

• Initial Rapid Release version August 2, 2002
• Latest Rapid Release version July 12, 2008 revision 018
• Initial Daily Certified version August 2, 2002
• Latest Daily Certified version July 12, 2008 revision 019
• Initial Weekly Certified release date August 7, 2002

Click here for a more detailed description of Rapid Release and Daily Certified virus definitions.

Threat Assessment

Wild

• Wild Level: Low
• Number of Infections: 0 - 49
• Number of Sites: 0 - 2
• Geographical Distribution: Low
• Threat Containment: Easy
• Removal: Easy

Damage

• Damage Level: Low

Distribution

• Distribution Level: Medium