Rialtus (rialtus) wrote,

New worm

So there is a new virus/worm going around. It's an email that says you've gotten a virus or worm, and to encourage you to open a ZIP file that says it's a patch.

Please, do yourself a favor, and don't open that file.

Trend Micro: http://www.trendmicro.com/vinfo/virusencyclo/default5.asp?vname=worm_nuwar.aok

SANS info:
We've received a bunch of emails in the past few minutes indicating the possible presence of a new Worm.

We are being told that it is a "Nuwar/Zhelatin" virus with Virtual Machine detection capabilities.

Apparently it indicates itself as a "Patch" for the "New worm" that is going around (whatever that may be, there are just so many I could choose from!)

The Subject of the email (that we have seen so far) say:
"Worm Alert!"
"Worm Detected"
"Virus Alert"
"Trojan Detected!"
"Worm Activity Detected!"
"Spyware Detected!"
"Dream of You"
"Virus Activity Detected!"

It has two attachments, one being an image with 'panic-worded text', and the other is a password protected zip file, whose password is revealed in the image.

The zip file appears to be named "patch-.zip".
Tags: virus
  • Post a new comment


    default userpic

    Your reply will be screened

    Your IP address will be recorded 

    When you submit the form an invisible reCAPTCHA check will be performed.
    You must follow the Privacy Policy and Google Terms of use.