According to e-mail security firm MessageLabs, the worm only affects computers running Microsoft's Windows operating system. It appears to have various subject lines, often referring to Lavigne.
The worm is activated once the recipient opens the attachment which can be called AvrilLavigne.exe, AvrilSmiles.exe or, in reference to Lavigne's current hit, Sk8erBoi.exe.
The worm collects e-mail addresses from a number of files that it searches for on the recipient's hard disk, and uses these addresses to send a copy of itself. On the 7th, 11th or 24th day of the month, the worm will also use the infected PC's web browser to connect to Avril Lavigne's web site.
Additionally, the worm can access the contents of the recipient's address book and mailbox for other e-mail addresses. According to MessageLabs, the worm also appears to have the ability to spread through IRC and ICQ chat programs and various network shares including KaZaa.
MessageLabs said that, only yesterday, it blocked over 9,000 e-mails carrying the virus.
More technical information on the worm is available from:
securityresponse.symantec.com/avcenter/venc/data/w32.
[email protected]
A removal tool can be found at:
securityresponse.symantec.com/avcenter/venc/data/w32.lirva.
removal.tool.html