Email-Worm.JS.CoolNow

Technical Details

This is a virus-worm that spreads via the Internet using MSN Messenger (instant messaging program). The worm itself is a JS-script (Java Script) located in an HTML file. It sends messages that contain an URL pointing to an infected Web page.

When the worm is executed, it obtains the MSN Messenger contact list, and sends to all its recipients the following message:

“URGENT – Go to http://www.rjdesigns.co.uk/cool Now”

This address points to an HTML-file, which contains the worm’s body.

After sending infected e-mail messages, the worm uses a script, which is located at the same site, to send a e-mail message to “jonathansmith288@hotmail.com” . This message contains the IP address of the infected computer, and redirects the user to the following address:

“http://www.rjdesigns.co.uk/cool/go.htm”

The worm doesn’t contain any payloads.