Malware type: Worm

Aliases: Email-Worm.Win32.Ronoper.r (Kaspersky), W32.Ronoper.Worm (Symantec), Worm/Ronoper.R (Avira), Mal/Heuri-D (Sophos),

In the wild: No

Destructive: No

Language: English

Platform: Windows 95, 98, ME, NT, 2000, XP

Encrypted: No

Description: 

This worm propagates via email and Internet Relay Chat. Its code also indicates that it may propagate via Kazaa.

To propagate via email, it sends out the following email message to all addresses in the user's contact list with its copy as attachment:

Subject: Re: Pictures
Message body:
Hi ,
I finally can find time to send you the pictures that you wanted from me..
Check The Attachment.. !
Attachment: My Pictures.SCR

Its IRC component, SYSSCRIPT.EXE, is detected as IRC_RONOPER.R. This component file attempts to send out copies of this worm through IRC.

This worm uses the icon typically associated with JPEG files. It runs on Windows 95, 98, ME, NT, 2000, and XP.

For additional information about this threat, see:
Solution
Technical Details

Description created: Jul. 13, 2003 10:22:55 PM GMT -0800
Description updated: Jul. 13, 2003 11:06:03 PM GMT -0800

Search a new malware

Tell us how we did. Take our quick survey.