Microsoft is aware of reports of a new mass mailer worm named Wallon that attempts to entice users into visiting a spoofed web site. If visited, a malicious Windows Media Player file, "wmplayer.exe" is downloaded into the user's machine which overwrites a user's existing Windows Media Player file. The PC becomes infected and the malicious Windows Media Player executable file is immediately launched. This allows the worm to then send itself to all contacts in a computer's address book. Customers running Windows Media Player 7.1, Windows Media Player for XP and Windows Media Player 9 Series on any version of Windows that have not installed MS04-013 are impacted by Wallon if they have received the email and visited the malicious website which appears to users as www.security-warning.biz.

This worm exploits the vulnerability fixed in Microsoft Security Update MS04-013 on April 13, 2004.