TrendLabs Malware Blog
Glossary
TrendWatch
TrendLabs Twitter
WORM_GIFT.C
Overview

Malware type: Worm

Aliases: W32.Gift.32768, W32/Gift@mm, Win32/HLLW.Gift, I-Worm.Gift

In the wild: Yes

Destructive: No

Language: English

Platform: Windows 98, ME, NT, 2000, XP

Encrypted: No

Overall risk rating:


Reported infections:

Damage potential:

High

Distribution potential:

High

Description: 

This worm propagates via email. It sends copies of itself as attachment to email messages it sends out. It uses Microsoft Word to compose email messages.

Users are advised to be wary of email messages with any of the following Subject lines:

  • benchmark
  • cool mail
  • Cracks
  • Damn crack...
  • Disk tool
  • freeIRC beta mail list
  • Honey ;)
  • IE Plug-in
  • IE5 security patch
  • Improve your site
  • JsvaScript 4 Docs
  • My Rom list
  • NS Plug-in
  • Secure Communications Inc.
  • Sex Farm - Adult contents
  • Sexy game
  • Shield PAK Installation
  • VB examples
  • y2k fix
  • your dlls

For the complete details of the email message that this worm sends, users can check the Technical Details section.

Upon first execution, this worm displays a message box containing the following strings:

Install error
File data corrupt:
probably due to bad data transmission or bad disk access

This worm runs on Windows 98, ME, NT, 2000, and XP.

For additional information about this threat, see:
Solution
Technical Details

Description created: Jan. 1, 2005 2:31:14 PM GMT -0800
Description updated: Jan. 1, 2005 9:02:41 PM GMT -0800

Search a new malware

Tell us how we did. Take our quick survey.