Just got this from my MIS dept.
While it's not widespread yet, a worm called WINEVAR.A is making the rounds and is likely to do a great deal of damage to unprotected Windows computers. According to this technical description, the worm changes the ownership information in the computer's registry, kills antivirus programs, and infects the victim machine with the Funlove virus. It also mails itself to the user's e-mail contacts.
But that's not all.... It gets worse. The next time the machine is booted, the worm displays a dialogue box with an insulting message: "What a foolish thing you have done!" When the dialogue box is dismissed, the worm attempts to delete all the files on the hard disk.
Unfortunately, WINEVAR.A is more virulent than some published accounts say it is. For example, a description in The Register states that one has to click on an attachment to trigger the worm. But alas, this is only true if the user is running an e-mail program other than Microsoft Outlook or Outlook Express.
According to antivirus vendor Trend Micro, the worm "uses a known email exploit that causes the attachment to automatically execute when the message is viewed or previewed on Internet Explorer-based email clients, such as Microsoft Outlook and Outlook Express." It is this "feature" that should be of real concern to users and network administrators, as it may make WINEVAR.A as contagious as the ubiquitous Klez worm.
Complicating matters, new reports indicate that some Winevar variants automatically execute, while others do not.
