REMOVAL COMMENTS:
http://vil.nai.com/vil/content/v_99075.htm
http://www.symantec.com/avcenter/venc/data/pf/w32.stator@mm.html
***************
"TheBat!" email client - W32/Stator.worm
Name: W32/Stator.worm (NAI)
Aliases: I-Worm.Stator (AVP), W32.Stator@mm (NAV), W32/Stator (Panda)
Type: Internet worm Platforms: Windows 32-bit using TheBat! email
Virus Characteristics
This worm is the first to use the "TheBat!" email client in order to mail itself to other users. The worm arrives as an attachment with the name "photo1.jpg.pif". When executed, the worm displays a JPEG image of a girl sitting next to a likeness of Ronald MacDonald to hide it activity.
It searches for target addresses in the client's database and sends a copy of itself as an attachment to an email. It mails itself with a fake email header using the following mail server: SMTP.MAIL.RU. During execution, the image PHOTO1.JPG is saved to disk and displayed in the user default JPG image viewer. The message body is written in Russian in the Cyrillic alphabet. The translated text appears as follows:
Hello!
Your address was given to me by a common friend of ours (the first address that came to his mind) I am a newcomer to the Internet and have just got this mailbox! So this is the very first time I am writing an e-mail!!! He said that if I had any questions, I could ask you... I am pretty cute and sociable. (have a look at the photo) I'm waiting for a reply from you!!! Write me a bit about yourself and what you would like to know about me. Good bye! Good bye! :)))))))))
