Malware Purveyors Use Gossip to Lure Spam Recipients

According to security specialists at TrendLabs, while gossip and rumor regularly draw the interest of numerous people all over the world, they also draw the interest of cyber-criminals.

The TrendLabs specialists state that it is barely astonishing to observe that online crooks are utilizing this aspect rigorously to disseminate their malware, as reported by PC1NEWS on June 22, 2009.

Understandably, the latest malicious campaign that uses gossip concentrates on infecting victims' computer systems with a virus that is being disseminated through phony e-mails posing as messages from YouTube.

The specialists maintain that the text of this unique spam mail that is transmitted arrives in the Portuguese language as it encourages probable victims to follow a link inside the e-mail while the message claims to present an exciting video from YouTube.

However, when the link is clicked, it leads to the loading of Video.com that TrendLabs identified as a PC worm dubbed WORM_RUNONCE.G. Subsequently, when the worm finds a place on a computer, it utilizes its own 'Simple Mail Transfer Protocol' (SMTP) to dispatch e-mails to all the contacts of the infected user.

In the meantime, the specialists said the e-mails, which arrive in pre-arranged format contain a file attachment. According to them, this attachment named PP.exe is actually a duplicate of WORM_RUNONCE.G that puts at risk of infection from the same malware, each of those whose e-mail ID is listed in the infected user's address book.

WORM_RUNONCE.G has some other names such as W32/Chir@MM, W32/Thecid.B@mm, W32.Chier@mm, I-Worm.Win32.ChiHack and I-Worm.Runonce.

According to the TrendLabs' specialists, the e-mail's captivating nature might simply be sufficient to arouse inquisitiveness within the minds of the recipients who may then proceed to view the e-mail that has the malicious program.

Much of the malware purveyors' success relies on what kind of rumor/gossip they manage to create i.e. whether or not that rumor/gossip is sufficiently interesting for the target victims.

Hence, gossip readers are advised to be careful of videos on video-sharing websites particularly YouTube as attempts to watch them could result in malware downloads that could even lead to the crash-down of their systems.

» SPAMfighter News - 02-07-2009

SPAMfighter is a free spam filter for Outlook, Outlook Express,Windows Mail and Thunderbird - Read more

SPAMfighter Exchange Module is a spam/virus filter for Exchange server - Free 30 days trial

Remove Spyware with SPYWAREfighter - Free 30 days trial