This virus alert from Symantec rated the virus as a "moderate threat." Advise members to download virus definitions of their security system.

What is and how does it affect me?

is a mass-mailing worm that opens a backdoor on TCP port 8866. The worm uses its own SMTP engine for email propagation. It can also contact the author of the worm with the port on which the backdoor listens and a randomized ID number.

The email has the following characteristics:

Subject: ID ... thanks
Attachment: .exe

Notes: Beta definitions 27975, dated February 17, 2004, 5:20AM PT, or later
will detect this threat. Initial builds may detect this treat as or

This worm is currently undergoing analysis. The record at Security Response will be updated as information becomes available.

anna22