W32.Fourseman.A

W32.Fourseman.A is a mass-mailing worm that attempts to send itself to all the email addresses it finds in the .htm, .html, .htt, and .dbx files on an infected computer.

The email message has the following characteristics:
Subject: Very important patch!
Attachment: The attachment is one of the following:

• Win_Security_Patch_2602.exe
• SProcess.exe
• Great_Virus_Creation_Kit.exe

NOTE: Symantec Security Response could not reproduce these actions in the lab environment. The mass-mailing portion of the worm does not work as intended by the author.

W32.Fourseman.A@mm also attempts to terminate many different security products.

Protection

• Initial Rapid Release version April 8, 2003
• Latest Rapid Release version July 19, 2008 revision 019
• Initial Daily Certified version April 8, 2003
• Latest Daily Certified version July 19, 2008 revision 018
• Initial Weekly Certified release date April 9, 2003

Click here for a more detailed description of Rapid Release and Daily Certified virus definitions.

Threat Assessment

Wild

• Wild Level: Low
• Number of Infections: 0 - 49
• Number of Sites: 0 - 2
• Geographical Distribution: Low
• Threat Containment: Easy
• Removal: Moderate

Damage

• Damage Level: Medium

Distribution

• Distribution Level: Low