1/13: Wurmark-E Worm Arrives As Zip Attachment
January 13, 2005

W32/Wurmark-E is a mass mailing worm which sends itself as a zip attachment to email addresses found on the infected computer. When run the worm displays the image uglym.jpg as it installs itself on the computer.

W32/Wurmark-E drops several files to the Windows system folder. W32/Wurmark-E will drop attached.zip, which is a zip file containing the worm, and xxz.tmp, which is a copy of the worm. It will also drop the following clean files:

ANSMTP.DLL
bszip.dll
uglym.jpg

More information can be found at Sophos page.