According to e-mail security firm MessageLabs, the worm only
affects computers running Microsoft's Windows operating system. It
appears to have various subject lines, often referring to
Lavigne.
The worm is activated once the recipient opens the attachment
which can be called AvrilLavigne.exe, AvrilSmiles.exe or, in
reference to Lavigne's current hit, Sk8erBoi.exe.
The worm collects e-mail addresses from a number of files that
it searches for on the recipient's hard disk, and uses these
addresses to send a copy of itself. On the 7th, 11th or 24th day of
the month, the worm will also use the infected PC's web browser to
connect to Avril Lavigne's web site.
Additionally, the worm can access the contents of the
recipient's address book and mailbox for other e-mail addresses.
According to MessageLabs, the worm also appears to have the ability
to spread through IRC and ICQ chat programs and various network
shares including KaZaa.
MessageLabs said that, only yesterday, it blocked over 9,000
e-mails carrying the virus.
More technical information on the worm is available from:
securityresponse.symantec.com/avcenter/venc/data/w32.
lirva.a@mm.html
A removal tool can be found at:
securityresponse.symantec.com/avcenter/venc/data/w32.lirva.
removal.tool.html
