W32/Marq-A is an email worm that works by sending an email containing a link to a webpage which, when activated, will reportedly cause the worm to be downloaded as zelig.scr. At the time of analysis the webpage in question was not available to confirm the reports.
The email will have the following characteristics:
Subject line: Il momento e' catartico
Message text: Ricevo e cortesemente inoltro,.... un premio per la genialita hanno reso mitico un salva schermo scaricalo, "poesie catartiche", che non sai cosa ti perdi
ciao
Attached file: There will be no attachment to the email.
The text "poesie catartiche" in the message text contains the link to the page that is reported to download the worm.
W32/Marq-A sends the email to all entries in the user's Windows Address Book.
W32/Marq-A changes the marquee screensaver on Windows to contain the text "A volte ti sento cos vicinia...A volte ti sento cos lontana...Certo che hai proprio un cellulare di merda!".
When the worm has run, a webpage (different to the one contained in the link in the email) will be opened. This page was also unavailable at the time of analysis.