New worm masquerades as Microsoft update

Zardon · Mar 8, 2004, 09:21 PM

This was posted earlier, but im bringing it back up due to its signficance.

"A new variant of the Sober worm has surfaced this morning, antivirus specialist F-Secure has warned.
Sober D pretends to be a Microsoft software update that protects against a new version of the MyDoom worm.

Once activated the worm displays a patch loading screen, but harvests email addresses and mails itself out using its own SMTP engine.
The email, written in either English or German, has the headline 'Microsoft alert: please read!' The body text adds: 'New MyDoom virus variant detected - please download this digitally signed attachment.'

Paul Bushen, technical manager at F-Secure UK, told vnunet.com: "The social engineering is good enough to do the job of fooling people.
"People are not learning quickly that Microsoft does not send out emails like this.

"It's like remembering to back up your hard drive regularly: something that's done religiously, but only by those who've been caught out in the past."
Sober A first surfaced in October 2003, again using either English or German text and a variety of social engineering techniques.

The virus has previously been disguised as a Microsoft email and as one from the Recording Industry Association of America."

VNUNET

Judas · Mar 8, 2004, 09:27 PM

all i'm worried about is... a virus somehow being used or seen by windows as an update and auto downloads... as for e-mail.. i'm carefull.. just hope my sisters are too.... i keep telling them "You open an attachment.... and i'll .... something to you"

**MIG-31** · Mar 8, 2004, 09:33 PM

surely the auto-updates should be safe(i hope) as i only update windows when they are on the auto-update site.

but if this is filtering through then this is quite a serious problem!!!

Mar 8, 2004, 09:21 PM	#1
Zardon DriverHeaven Founder Join Date: May 2002 Posts: 32,480 Rep Power: 179	New worm masquerades as Microsoft update This was posted earlier, but im bringing it back up due to its signficance. "A new variant of the Sober worm has surfaced this morning, antivirus specialist F-Secure has warned. Sober D pretends to be a Microsoft software update that protects against a new version of the MyDoom worm. Once activated the worm displays a patch loading screen, but harvests email addresses and mails itself out using its own SMTP engine. The email, written in either English or German, has the headline 'Microsoft alert: please read!' The body text adds: 'New MyDoom virus variant detected - please download this digitally signed attachment.' Paul Bushen, technical manager at F-Secure UK, told vnunet.com: "The social engineering is good enough to do the job of fooling people. "People are not learning quickly that Microsoft does not send out emails like this. "It's like remembering to back up your hard drive regularly: something that's done religiously, but only by those who've been caught out in the past." Sober A first surfaced in October 2003, again using either English or German text and a variety of social engineering techniques. The virus has previously been disguised as a Microsoft email and as one from the Recording Industry Association of America." VNUNET

Mar 8, 2004, 09:33 PM	#3
MIG-31 HardwareHeaven News Mod Join Date: Dec 2002 Location: Nottingham,UK Posts: 56,843 Rep Power: 471 System Specs	surely the auto-updates should be safe(i hope) as i only update windows when they are on the auto-update site. but if this is filtering through then this is quite a serious problem!!! __________________ Please Post Your News Submissions Here