Grum worm spreads as IE7 'beta'

Spammed worm catches users who do not keep up with the news.

A new worm was spammed out this weekend purporting to be a beta version of Microsoft's Internet Explorer 7 browser.

Emails with spoofed headers such as admin@microsoft.com contain a file that claims to be a beta version of the browser, despite the fact that the full code was released in October 2006. The 'ie7.0.exe' file contains the Grum-A worm.

"Worms like this are spreading because so many people have still not learned to be suspicious of unsolicited emails, even if they claim to come from well-known companies like Microsoft," said Graham Cluley, senior technology consultant at Sophos.

"The problem is that the email looks genuine to the casual observer, and the image displayed looks near-identical to the imagery Microsoft is using on its website to promote Internet Explorer 7.0."

Once installed the worm infects executable files in the Windows Registry and copies itself to \winlogon.exe. It also installs itself onto the systems.dll.

Infected computers can then have code downloaded remotely without the user's knowledge, allowing the PC to be used to send spam or take part in denial of service attacks.

Copyright ©v3.co.uk