Rule:--Sid:727--Summary:This event is generated when worm activity is detected. More specifcallythis event indicates possible "My Romeo" propogation.--Impact:Serious. The victim host may be infected with a worm.--Detailed Information:This worm propogates via electronic mail and exploits a knownvulnerability in the way that versions of Microsoft Outlook and InternetExplorer handle trusted HTML pages. The worm is launched via a compiledHTML file (.chm) which is used by Microsoft WIndows Help.The executable part of the worm is called from within the trustedcompiled HTML file. The worm attempts to propagate using hard codedaddresses of SMTP servers.This worm is also Known As: Romeo and Juliet, W32/Verona, TrojBlebla.A--Affected Systems:	Microsoft Windows 9x	Microsoft Windows 2000--Attack Scenarios:Symantec Anti-Virus center states that the worm arrives as an emailmessage that has an HTML body and two attachments named Myjuliet.chmand Myromeo.exe. The subject of the email is selected at random fromthe following set:Romeo&Juliethello worldsubjectble bla, beeI Love You ;)sorry...Hey you !Matrix has you...my picturefrom shake-beer--Ease of Attack:Simple. This is worm activity.--False Positives:Legitimate electronic mail containing the known subject lines used byMyRomeo may cause this rule to generate an event.--False Negatives:None Known--Corrective Action:Apply the appropriate vendor supplied patches and service packs.Use Anti-Virus software to detect and delete virus laden email.This worm makes changes to the system registry, removal of the affectedregistry keys should be done using an appropriate virus removal tool orby an experienced Windows administrator.--Contributors:Original Rule Writer Max Vision <vision@whitehats.com>Sourcefire Research TeamNigel Houghton <nigel.houghton@sourcefire.com>--Additional References:McAfeehttp://vil.nai.com/vil/content/v_98894.htmSymantec Security Responsehttp://securityresponse.symantec.com/avcenter/venc/data/w32.blebla.worm.html--