[iwar] [fc:Experts.Warn.of.Christmas.Computer.Worm]

From: Fred Cohen (fc@all.net)
Date: 2001-12-19 21:27:55

Next message: Fred Cohen: "[iwar] [fc:More.on.Arafat's.Trick.Peace.Initiative]"
Previous message: Fred Cohen: "[iwar] [fc:*MAJOR.SECURITY.BREACH.AT.CCBILL**]"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]

Message-Id: <200112200527.fBK5Rt730583@red.all.net>
To: iwar@onelist.com (Information Warfare Mailing List)
Organization: I'm not allowed to say
From: Fred Cohen <fc@all.net>
Mailing-List: list iwar@yahoogroups.com; contact iwar-owner@yahoogroups.com
Precedence: bulk
Date: Wed, 19 Dec 2001 21:27:55 -0800 (PST)
Subject: [iwar] [fc:Experts.Warn.of.Christmas.Computer.Worm]
Reply-To: iwar@yahoogroups.com
Content-Type: text/plain; charset=US-ASCII
Content-Transfer-Encoding: 7bit

Wednesday December 19 07:13 PM EST 

Experts Warn of Christmas Computer Worm

By Paul Eng ABCNEWS.com

Computer security experts warn 'Zacker,' a new holiday-themed computer
virus is winding its way through the Internet.

Computer security experts warn a new holiday-themed computer virus is
winding its way through the Internet today.

The worm, known by several names including W32.Zacker.C and
W32.Maldal.C, is similar to the recent Goner worm in that it attacks
computers that run Microsoft's Windows operating systems and Microsoft's
Outlook e-mail program.

The new worm arrives in an e-mail with the subject line of "Happy New
Year." The body of the message says: "Hii [sic] I can't describe my
feelings. But all i [sic] can say is Happy New Year :) bye."

Attached to the e-mail is a file called "Christmas.exe" which contains
the malicious computer programming. When an unsuspecting recipient opens
the file, the computer displays a holiday greeting showing Santa Claus
and a message that says: "From the heart, Happy new year [sic]!"

As the PC shows the electronic greeting, security experts say the worm
sends copies of itself to all the e-mail addresses stored in the
now-infected computer's Outlook program. The worm will then begin to
delete files - including any anti-virus programs and possibly critical
Windows components - from the computer's hard drive and install
instructions to spread the worm every time the computer is restarted.

The worm also appears to spread through instant chat programs such as
Microsoft's Messenger.

Will It Ruin Christmas? 

Computer security experts don't yet know who crafted the malicious worm
- or even if it will reach outbreak proportions of previous worms such
as Nimda or Code Red. 

Ian Hameroff, director of anti-virus solutions at Computer Associates,
says the company has rated the threat as a medium- to high-risk threat.
"We received several reports across Europe where several thousand
computers have been infected," says Hameroff.

But April Goosetree of anti-virus maker McAfee.com said the company
hasn't heard of any massive outbreak of the worm today either. The
company rates the Zacker worm as a low-level threat.

Still, experts agree that the worm does have potential to rapidly spread
given its apparently benign holiday greeting. "If this is spreading,
it's because of the social aspect - because the file is named
'Christmas,' " says Jerry Freese, director of intelligence for Vigilinx,
a computer security firm. 

Most anti-virus software makers have already developed and released
updates to their security programs to detect and remove the new worm.

Security experts advise users to update their anti-virus programs with
these latest fixes to guard against the new worm. They also stress that
suspicious files sent by e-mail shouldn't be opened without first
checking with the sender.

"People are expecting holiday greetings [via e-mail]," says Computer
Associates' Hameroff. "But this is one holiday gift that you won't like
and you definitely won't be able to return it once it's opened." 

------------------------ Yahoo! Groups Sponsor ---------------------~-->
Send FREE Holiday eCards from Yahoo! Greetings.
http://us.click.yahoo.com/IgTaHA/ZQdDAA/ySSFAA/kgFolB/TM
---------------------------------------------------------------------~->

------------------
http://all.net/ 

Your use of Yahoo! Groups is subject to http://docs.yahoo.com/info/terms/

Next message: Fred Cohen: "[iwar] [fc:More.on.Arafat's.Trick.Peace.Initiative]"
Previous message: Fred Cohen: "[iwar] [fc:*MAJOR.SECURITY.BREACH.AT.CCBILL**]"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]

This archive was generated by hypermail 2.1.2 : 2001-12-31 21:00:00 PST