Porn Worm infects computers by mass mailing a file that looks like a folder
March 21, 2007 (Press Release) --
Security Experts at MicroWorld Technologies advise computer users to be wary of an email that comes as a zipped file, promising Japanese and Indonesian pornography. The attachment carries a Worm named ‘Win32.VB.co’, which infects computers and starts a mass mailing campaign to email addresses found in the victim’s address book.
‘Japanese Porn’, ‘Miss Indonesian’ and ‘Hello’ are some of the subject lines of the emails sent out from the infected computer, with message contents like ‘F****g with me:D’, ‘Please read again what I have written to you’, ‘hey Indonesian porn, Agnes Monica's porn’ and more.
The names of the attachments may be ‘Doc 8328328.zip’, ‘file 2151981.zip’ and ‘Miyabi 5315261.zip’, just as these numbers are generated randomly. The recipients of the mail get infected once they download and run the attachment.
The email Worm has got some note-worthy features. While sending mails to the entities found in the address book it spoofs the sender’s ID as the victim’s ID. Once you extract the file it shows a folder icon, though in fact it is an exe file. The unsuspecting user will try to open the imposter ‘folder’ and will run the exe in the bargain.
What follows is even more interesting! Win32.VB.co proceeds to create an exe file inside every folder in the computer, with the name of the file being the same as that of the folder. Here too, the file shows up with a folder icon. The worm then tries to spread by copying itself into popular file sharing applications. It can log keystrokes and send that to a remote attacker in order to facilitate Identity Theft. It also attempts to turn off AntiVirus applications.
Other than the email route, Win32.VB.co can also spread via shared folders and P2P applications. This will enable this Worm to spread in a large network within a span of few hours forcing shut down of networks in some cases.
To secure Enterprises and home computer users from threats like these, MicroWorld offers eScan range of AntiVirus and Content Security solutions. ‘MailScan from MicroWorld protects the email infrastructure of business houses, while eConceal provides a comprehensive Network Firewall for computers.
‘Japanese Porn’, ‘Miss Indonesian’ and ‘Hello’ are some of the subject lines of the emails sent out from the infected computer, with message contents like ‘F****g with me:D’, ‘Please read again what I have written to you’, ‘hey Indonesian porn, Agnes Monica's porn’ and more.
The names of the attachments may be ‘Doc 8328328.zip’, ‘file 2151981.zip’ and ‘Miyabi 5315261.zip’, just as these numbers are generated randomly. The recipients of the mail get infected once they download and run the attachment.
The email Worm has got some note-worthy features. While sending mails to the entities found in the address book it spoofs the sender’s ID as the victim’s ID. Once you extract the file it shows a folder icon, though in fact it is an exe file. The unsuspecting user will try to open the imposter ‘folder’ and will run the exe in the bargain.
What follows is even more interesting! Win32.VB.co proceeds to create an exe file inside every folder in the computer, with the name of the file being the same as that of the folder. Here too, the file shows up with a folder icon. The worm then tries to spread by copying itself into popular file sharing applications. It can log keystrokes and send that to a remote attacker in order to facilitate Identity Theft. It also attempts to turn off AntiVirus applications.
Other than the email route, Win32.VB.co can also spread via shared folders and P2P applications. This will enable this Worm to spread in a large network within a span of few hours forcing shut down of networks in some cases.
To secure Enterprises and home computer users from threats like these, MicroWorld offers eScan range of AntiVirus and Content Security solutions. ‘MailScan from MicroWorld protects the email infrastructure of business houses, while eConceal provides a comprehensive Network Firewall for computers.
Email
Print
SPAM
