The first of the season's 9/11 anniversary worms has been detected by security firms this week, and more are likely to follow.
The worm, dubbed W32/Neroma@MM and Worm/Icebut.A by security vendors, typically shows 'Nice butt, baby!' in the e-mail message's body, displays the subject heading 'It's Near 911!', and disguises its payload as an attachment with the .jpg extension. Although the extension may fool some people into thinking it's a digital image--and launching the file--it's actually an executable that installs on the infected machine.
If recipients open this attachment, Neroma will try to delete files on the 1st, 4th, 8th, 12th, 16th, 20th, 24th, and 28th day of each month. Neroma propagates by mailing itself to addresses it culls from an infected system's Microsoft Outlook address book.
|