Cuerpo is an email worm that propagates by using the Outlook address book of infected systems. The worm infects computers that are running Windows 9x, with Internet Explorer 5.0 installed without the Scriptlet.TypeLib hotfix.
The email, in HTML format, is blank, bar from script that allows the worm to execute. Upon opening the email, the user may receive an ActiveX notification. Upon clicking an option, the worm will execute. The worm will attempt to collect email addresses from the infected computer, in order to spread further.
The worm adds itself as a signature in Outlook, meaning that it is attached to all composed emails. As it has no visual appearance, it may not be obvious to the user that their signature has seen modification.
The worm, to spread, will first select a random subject line from Outlook's inbox, and then select a random attachment name, again from Outlook's inbox. The worm will attach itself to emails with that attachment name, with the aforementioned subject line. Shortly after initial infection, Internet Explorer's homepage will be replaced with a blank page (assumedly about:blank), being replaced a few days later with a link to "freedonation dot com".
The worm, in addition to using Outlook to propagate, will search for .dat, .mbx, .dbx, .txt, .wab and .na2 files, searching for email addresses that can be used. These are collected and forwarded to a web server, which will send infected emails to the addresses harvested. It is unknown whether this web server is still active.
- Kaspersky Threats, Email-Worm.VBS.Cuerpo