Mass email worm threatens accounts

A new mass-mailing worm that may conjure up images of Nimda and Code Red appears to be threatening email infrastructures.

Using the subject line, "Here you Have", the messages began invading inboxes yesterday, Craig Schmugar, threat researcher at McAfee Avert Labs, said in a blog post. The emails contain a link that appears to lead to a PDF file but actually directs users to a malicious .SCR executable.

Researchers are unsure of the extent of the outbreak.

If users click on the link, they are prompted to install the worm, which attempts to disable security software and, in the spirit of the worms that crippled businesses nearly a decade ago, send a copy of itself to all email contacts belonging to the victim.

"Once [the computer is] infected, the worm attempts to send the aforementioned message to email address book recipients," Schmugar wrote. "It can also spread through accessible remote machines, mapped drives, and removable media via AutoRun replication."

The link included in the emails studied by McAfee is no longer live, but researchers warn that multiple variants may be spreading.

McAfee suggests administrators filter out .SCR files from their email systems.

See original article on scmagazineus.com