Win32:Verona

is an Internet worm. It arrives to you as an attachment to e-mail messages. Actually, there are two files attached to the infected message: MYJULIET.CHM and MYROMEO.EXE. When such message is viewed via Microsoft Outlook, the script inside the message body is executed and the file MYJULIET.CHM is viewed via Windows Help Browser. This file contains another piece of code which runs the program MYROMEO.EXE. This file contains the worm itself. It tries to use six different SMTP servers in Poland which have the relay open (i.e. they enable to send anything through them) and sends itself to the addresses from the Outlook address book. The subject is randomly selected from the following list: "Romeo&Juliet", ":))))))", "hello world", "!!??!?!?", "subject", "ble bla, bee", "I Love You :)", "sorry...", "Hey you !", "Matrix has you...", "my picture", "from shake beer". Win32:Verona is based on the security hole in Microsoft Outlook and Outlook Express. There exists a patch which disables such kind of malware to spread. Removal: The worm removal is quite simple: just delete the files MYJULIET.CHM and MYROMEO.EXE. There is another variant of this worm. It uses more SMTP servers (18) and also uses slightly different set of subject line. It also modifies the registry so the virus is activated when different files are used in the computer (EXE, JPG, BMP, GIF, AVI, MP3, ZIP, ARJ, REG and several others). Any avast! with VPS file dated after 24th November 2000 is able to detect this virus.