Malware type: Worm

Aliases: Email-Worm.Win32.Sowsat.d (Kaspersky), W32/Sowsat.gen@MM (McAfee), W32.Sowsat@mm (Symantec), W32/Sowsat-D (Sophos), Worm:Win32/Sowsat.D (Microsoft)

In the wild: No

Destructive: No

Language: English

Platform: Windows 95, 98, NT, 2000, ME, XP

Encrypted: No

Description: 

This memory-resident worm uses its own Simple Mail Transfer Protocol (SMTP) engine to mass-mail itself to addresses it finds in HTML files. It sends email in four variations:

Email 1

From: AVP.Mailer@avp.com
Subject: AVP-Virus-Warning
Message body: New virus in "The Wild" called "W32/Cow".Spreads through e-mail and IRC.A solution is this free program.Send this message to your friends. Thank you, AVP Team
Attachment: <running worm copy>

Email 2

From: piadeiros@risadinha.com.br
Subject: Piada do Paciente Galo
Message body: Um paciente chegou com o psiquiatra e disse: - Doutor, eu sou um galo...
Attachment: <running worm copy>

Email 3

From: piadeiros@risadinha.com.br
Subject: Ei, psiu...
Message body: Nada. Te peguei...Gosto muito de voc , viu ? Estou com saudades. De seu amigo, Jonas.
Attachment: <running worm copy>

Email 4

From: notice@programese.kit.net
Subject: Bom dia !!!
Message body: Feliz Aniversrio !!!
Attachment: <running worm copy>

This malware runs on Windows 95, 98, NT, 2000, ME and XP.

For additional information about this threat, see:
Solution
Technical Details

Description created: Aug. 12, 2003 1:43:19 PM GMT -0800

Search a new malware

Tell us how we did. Take our quick survey.