Type: Trojan
Size: 12660 Byte
System Affected: Windows98, 95, Me, 2000, Xp, NT
Others Known As:

Characteristics :

1) Opens a backdoor on TCP port 28000 - 28500 which allows the infected computer to be used as an email relay.

2-1) The email has the follwing characterictics :

From :

◊ [spoofed] email address taken at random from an email address collected from computer

Subject :

◊ Mail Delivery failure - [email_address@domain.com]

Body :

If the message will not displayed automatically, you can check original in attached message.txt.

Failed message also saved at: www.[domain.com]/inbox/security/read.asp?sessionid-(random 4 digit number)
(check attached instructions)

Attachment :

◊ "message txt (random number of spaces) mcafee.com"

2-2) Retrieves email addresses from the files with the following extensions:

◊ %root%\csrss.exe