W32/CTX is a worm that will be received in an e-mail as an attachment called SETUP.EXE. The icon for the file looks just like a standard Windows icon, except for the color. The message within the e-mail is a simple smiley ":)". While W32/CTX is in memory, it will scan all of the following file types for potential victims by picking out e-mail addresses: DBX, EML, HTM, HTML, IEX, MBX, NCH, TXT. W32/CTX uses several techniques designed to evade detection by anti-virus software products. (via)