Log in

No account? Create an account

Previous Entry | Next Entry

New worm

So there is a new virus/worm going around. It's an email that says you've gotten a virus or worm, and to encourage you to open a ZIP file that says it's a patch.

Please, do yourself a favor, and don't open that file.

Trend Micro: http://www.trendmicro.com/vinfo/virusencyclo/default5.asp?vname=worm_nuwar.aok

SANS info:
We've received a bunch of emails in the past few minutes indicating the possible presence of a new Worm.

We are being told that it is a "Nuwar/Zhelatin" virus with Virtual Machine detection capabilities.

Apparently it indicates itself as a "Patch" for the "New worm" that is going around (whatever that may be, there are just so many I could choose from!)

The Subject of the email (that we have seen so far) say:
"Worm Alert!"
"Worm Detected"
"Virus Alert"
"Trojan Detected!"
"Worm Activity Detected!"
"Spyware Detected!"
"Dream of You"
"Virus Activity Detected!"

It has two attachments, one being an image with 'panic-worded text', and the other is a password protected zip file, whose password is revealed in the image.

The zip file appears to be named "patch-.zip".



( 2 comments — Leave a comment )
Apr. 12th, 2007 06:48 pm (UTC)
*see icon*
Apr. 12th, 2007 06:53 pm (UTC)
I know, but...
( 2 comments — Leave a comment )