Security firms Wednesday warned that another virus began making its rounds on the Net this week, and this one is masquerading as a Microsoft security update.
The virus, a mass-mailing worm variously dubbed I-Worm.Gibe, W32/Gibe@mm, WORM_GIBE.A, etc., does not carry a destructive payload, but is capable of installing a backdoor Trojan which allows remote access to an infected system.
Gibe arrives as an attachment named Q216309.exe to a message that begins:
From: Microsoft Corporation Security Center
mailto:rdquest12@microsoft.com]
To: Microsoft Customer
Subject: Internet Security Update
Attachment: q216309.exe
Microsoft Customer,
this is the latest version of security update, the update which eliminates all known security vulnerabilities affecting Internet Explorer and MS Outlook/Express as well as six new vulnerabilities, and is discussed in Microsoft Security Bulletin
MS02-005. Install now to protect your computer from these vulnerabilities, the most serious of which could allow an attacker to run code on your computer.
News source: Internetnews
View: The Full Story
View: Virus Info - W32/Gibe@MM
The virus, a mass-mailing worm variously dubbed I-Worm.Gibe, W32/Gibe@mm, WORM_GIBE.A, etc., does not carry a destructive payload, but is capable of installing a backdoor Trojan which allows remote access to an infected system.
Gibe arrives as an attachment named Q216309.exe to a message that begins:
From: Microsoft Corporation Security Center
mailto:rdquest12@microsoft.com]
To: Microsoft Customer
Subject: Internet Security Update
Attachment: q216309.exe
Microsoft Customer,
this is the latest version of security update, the update which eliminates all known security vulnerabilities affecting Internet Explorer and MS Outlook/Express as well as six new vulnerabilities, and is discussed in Microsoft Security Bulletin
MS02-005. Install now to protect your computer from these vulnerabilities, the most serious of which could allow an attacker to run code on your computer.
News source: Internetnews View: The Full Story View: Virus Info - W32/Gibe@MM
The message then goes on to describe the vulnerabilities the worm purports to correct.
The worm, written in Visual Basic, uses Microsoft Outlook and its own SMTP engine to spread. When Q216309.exe it creates two copies of itself, drops the component which uses Outlook and SMTP to spread, creates a Backdoor Trojan that opens port 12378, creates a data file that it uses to store all e-mail addresses it finds, and creates another component that searches for e-mail addresses from the Outlook Address Book and all addresses found in .htm, .html, .asp, and .php files. Once the final component has those e-mail addresses, it writes them to the data file.
Finnish security firm F-Secure Corp. said Wednesday that victims can get rid of the worm by deleting all its components from an infected system. It noted that if some components are locked while Windows is active, they have to be deleted from pure DOS or renamed with a different extension with immediate system restart.
Many anti-virus firms have already updated their virus definitions to detect the worm.
Commenting has either been disabled on this article or you are not logged in. Click here to login or register, its free!
Note: Anonymous commenting is disabled in order to keep the quality of responses to a high standard.