Bush Worm Dances

[IkuTube]

Bush Worm Dances its Way into Computers

Source from Hardwarezone.com, May 21 2007

"Check out this animation of Bush!" says a message popping up in your MSN Messenger. If you click on the link that follows to see the president of America letting his hair down, you will be unwittingly inviting a Worm to do some fast-paced moves inside your computer, say Security Experts at MicroWorld Technologies.

A Worm named 'Worm.Win32.VB.au' spreads with the help of messages written in Spanish, which says 'mira esta animacion de bush', coming from known and unknown contacts. Translated to English, it reads as, 'See this animation of Bush'. After getting into a victim’s computer, the Worm quickly sends the malicious links to all contacts present.

"Using fake and real stories about world political leaders is a tried and tested way of malware proliferation," says Rohini Sonawane, Chief Operating Officer of MicroWorld. "From death stories of Vladimir Putin, to the heart attack of Australian Prime Minister to the resurrection of Boris Yeltsin, these ploys have always triggered an instant reaction from a good number of computer users."

Most such attacks in the past were in the form of emails carrying sensational attachments. But in the case of malwares using Instant Messengers like the one in question, it’s about just one click. The best Social Engineering is when you don’t give an opportunity for the targeted user to think and instead get her to act on her reflex, adds Rohini.

Win32.VB.au is written in Visual Basic language and comes with a size of 122,880 Bytes. The malware creates a few registry entries so that it gets executed every time the computer is started.

The IM worm does not contain any dangerous payload in its present form. But similar methods can be employed by Virus Writers in proliferating more destructive Worms or Trojan Downloaders in a possible second wave of attacks. Exploiting vulnerabilities in Instant Messengers is another mode of malware proliferation that’s getting increasing attention from Virus writers.

MicroWorld protects organizations and Enterprises against a wide spectrum of threats with futuristic Security Solutions. Powered by the MWL technology, eScan from MicroWorld provides round the clock protection for Servers and Desktops against Virus, Trojan, Mail and IM Worm, Adware, Spyware, Spam, Phishing and Content Security threats.

Users affected with Win32.VB.au can download and run MicroWorld’s free AntiVirus utility MWAV to clean their computers. You can download MWAV at http://www.mwti.net/products/mwav/mwav.asp.