The Caric-A worm promises an animation of the former US president and can be identified by the subject line "bill caricature" and the attached file "cari.scr".
Opening the file causes a picture to appear on the screen and triggers a mechanism that forwards the e-mail to anyone listed in a victim's address book.
The worm itself is a Windows PE EXE file about 11Kb in length, written in Visual Basic.
According anti-virus vendor Kapersky Labs, once installed in the system (after Windows reboot following infection) the worm checks the current date, if the current hour value is eight, the worm executes its payload routine, deleting the following files:
It also deletes .sys files in the Windows directory and .vxd, .sys, .ocx, and .nls files in the Windows system directory.
Natasha Staley, anti-virus consultant at Sophos, said the worm should not prove a threat to organisations and individuals who have learned the lessons of mass mailer worms from the Love Bug onwards. "Those practising safe computing should not be caught out," said Staley.