Tis' the season for malicious e-mail bearing gifts so beware of this innocent-looking music message lurking in your Inbox.
Another Christmas-related virus is on the loose. W32.Music arrives as an e-mail with a music file attached that accesses files found in Visual Basic Runtime 5 which are preinstalled in Windows 98 systems. The worm currently does not contain a dangerous payload but has the ability to update itself via the Internet.
How It Works
W32.Music arrives as an e-mail with the following information:
To: To all my friends
From: Test Mail
Subject: Testing to send file
Body: Hi, just testing email using Merry Christmas music file, not bad music.
Attachment: Music.com., Music.zip, or Music.exe
Users who click on the attachment will infect their computers if Visual Basic Runtime 5 files are present. The worm will display a window that reads "Merry Christmas" while playing a midi file rendition of "We Wish You A Merry Christmas." The worm will also alter a user's default browser page when first accessing the Internet. Music will then attempt to connect to the Internet to download updated versions of itself. Once updated, the worm will attempt to copy itself to all e-mail addresses found in .WAB (Windows Address Book) and .DBX files. The worm also alters the system registry file.
