Virus season has arrived, with a host of new worms coming out of the woodwork in the past couple of days. Leading the onslaught is the BugBear@MM worm that uses copies of previous e-mails to lure users into opening its attachment. Other worms doing the rounds include Opaserv.
According to MessageLabs, the BugBear worm was first captured on 29 September in Malaysia and has since been seen in more than 100 countries. Unlike many worms that target the US market first, BugBear has been most active in the UK, which tops the list with 55% of all reported "sightings", while incidences are also high in Australia and New Zealand.
The mass-mailing worm has a variable subject line and is most often based on existing e-mails found on the infected computer. It then uses these e-mails as its own subject line and mail body.
It carries an attachment 50 688-bytes in length. Symantec`s Security Response team reports that the worm is written in Microsoft Visual C++ and is able to capture keystrokes in the infected machine. It also attempts to disable a long list of security settings on the targeted machine.
MessageLabs says the worm also opens a port that could be used at a later point by a malicious hacker to access the machine.
Another worm doing the rounds is W32/Opaserv, a network-aware worm that tries to spread across unprotected network shares by copying a file called Scrsvr.exe to the target machines. Once installed, the worm tries to download updates from the www.opasoft.com site which appears to have already been closed down.
Symantec rates both Opaserv and BugBear as category three threats.
Top culprits
Virus companies yesterday issued their incident figures for the month of September. Kaspersky Labs and Central Command list the Klez worm at the top of their respective lists, although Kaspersky says Klez accounts for almost 80% of all reports, while Central Command says Klez accounts for only 30%.
However, Steven Sundermeier, product manager at Central Command, says the Klez worm accounted for more than 52% of all infections over the past four months.
The BugBear (also known as Tanatos) and Opaserv worms didn`t make it into last month`s figures but Sundermeier says their impact has been significant in the last two days. MessageLabs reports that BugBear accounts for more than 20 000 of the infections reported to the company in the past 24 hours. Klez infections are at a little more than 13 000.
Central Command`s top five for the month of September are: Klez (29.3%), Yaha.E (16.8%), Elkern.C (10.8%), SirCam (10.4%) and Nimda (4.7%).
Kaspersky Labs lists its top five as: Klez (72.93%), Lentin (23.62%), Wn95.CIH (0.27%), Win32.Filecoder (0.17%) and Macro.Word97.Thus (0.13%).
Share
