This section helps you to understand how it behaves

W32/Navidad is an email worm. The worm arrives in an email message with an attachment called NAVIDAD.EXE.

 

If the attached program is launched, it displays a dialog box containing the text "UI".

 

It then attempts to read new email messages and to send itself to the senders' addresses.

 

The worm copies itself into the Windows system directory with the filename WINSVRC.VXD and changes the registry so that it runs on Windows startup and before any file is run.

 

The worm also installs itself into the system tray.

 

 

If the user clicks on the icon, it displays a dialog box with the text "Nunca presionar este boton".

 

If the user clicks the button, the worm displays a dialog box with the title "Feliz Navidad" and the text "Lamentablemente cayo en la tentacion y perdio su computadora".