W32/Apost-A is an email-aware worm which makes use of the Microsoft Outlook mail client.
The worm arrives in an email with the following characteristics:
Subject line: "As per your request!"
Message body: "Please find attached file for your review. I look forward to hear from you again very soon.
Thank you."
When the attached file is executed it will try to copy itself to the floppy drive. It will also copy itself to C:windowsreadme.exe and add the Registry key HKLMSoftwareMicrosoftWindowsCurrentVersionRun
macrosoft = C:windowsreadme.exe.
The worm sends a copy of itself to every entry in the user"s Microsoft Outlook Address Book and then displays a small dialog box titled "Urgent!". This dialog box contains one single large button labled "Open".
If this button is pressed then the worm sends out further copies of itself and then displays an error message box with the title "WinZip SelfExtractor: Warning" and containing the error message "CRC error: 34#".
After the error message box is acknowledged the worm terminates.