W32.Socay.Worm

W32.Socay.Worm is a backdoor Trojan that contains worm functionality. It attempts to send itself to all the addresses in the Microsoft Outlook Address Book. The email characteristics are:
Subject: Re:VISA DE TRABAJO
Attachment: <Original file name>

The worm also tries to copy itself to drive A as Visa de Trabajo <multiple spaces> .exe

The backdoor component listens on port 8,520 for remote connections.

Protection

• Initial Rapid Release version January 15, 2003
• Latest Rapid Release version March 3, 2008 revision 035
• Initial Daily Certified version January 15, 2003
• Latest Daily Certified version March 3, 2008 revision 037
• Initial Weekly Certified release date January 15, 2003

Click here for a more detailed description of Rapid Release and Daily Certified virus definitions.

Threat Assessment

Wild

• Wild Level: Low
• Number of Infections: 0 - 49
• Number of Sites: 0 - 2
• Geographical Distribution: Low
• Threat Containment: Easy
• Removal: Moderate

Damage

• Damage Level: Medium

Distribution

• Distribution Level: Low