Strat.EQ Worm Propagates On Windows

Worm Strat.EQ amplifies by fixing its copy to e-mail messages, which it delivers to specific recipients with the help of its own 'Simple Mail Transfer Protocol' (SMTP) engine. The e-mail propagation does not need any 'user intervention' and so does not give any clue to the user that the worm is sending out e-mails from his account. The worm sends messages to e-mail addresses stored in the user's 'Windows Address Book' (WAB).

The worm attempts to trick recipients through the messages having different kinds of randomly selected subjects such as Error, Hello, Good Day, Mail Delivery System, Mail Transaction Failed, Mail Server Report, Test and Picture Status. The message body warns recipients that their PCs are infected with malware.

The e-mail says that their firewall has gathered the mails containing copies of the worm, which are being dispatched to the recipients' PCs. It says the virus is a new 'network worm' and sending such mails is common these days. The virus works on a new vulnerability in Windows to infect computer without the user's knowledge. The message claims that after installing on the user's computer it collects all e-mail Ids and sends out its copies to these addresses. It, therefore, advises recipients to install updates to erase the worm and bring back the machine to its original state. The e-mail ends, conveying regards and poses to come from some customer service.

As per reports of Trend Micro, the worm has double extension names to the attached file, except the file name, 'Update-KB {Random numbers}-x86, which always contains the EXE extension. The technique makes the user think the file to be non-malicious by seeing the first extension name before the second one.

The worm installs files as WORM_STRAT.EQ, WORM_STRAT.DX on Windows PC. It waits till the Internet connection is on and then tries to access number of URLs to download and install malicious files.

A suggestion for users is to update their anti-virus software and protect their computers from the worm infection. Micro Trend has released details and instructions for removal of the Strat.EQ worm, on its website.

Related article: Stration Worm Pretends to be Security Patch

» SPAMfighter News - 11/1/2006