Severity: Medium
Virus/Worm Summary:
Subject lines to avoid: include “Here you have,” or “Just for you,” and “This is the Free Dowload (sic) Sex Movies, you can find it Here”
Malicious email attachment: contains supposed links to PDF or WMV files, which actually link to malicious .SCR files
Impact: Spreads via your email contacts and through network shares. Infects your computer with various malware, and potentially steals information What to do: Make sure you are using updated antivirus software, and block .SCR files at your gateway (see below for details) “Here you have” Email contains fake and malicious PDF or WMV links
Severity: Medium
Virus/Worm Summary:
Subject lines to avoid: include “Here you have,” or “Just for you,” and “This is the Free Dowload (sic) Sex Movies, you can find it Here”
Malicious email attachment: contains supposed links to PDF or WMV files, which actually link to malicious .SCR files
Impact: Spreads via your email contacts and through network shares. Infects your computer with various malware, and potentially steals information What to do: Make sure you are using updated antivirus software, and block .SCR files at your gateway (see below for details)
About the Virus:
Late yesterday, various antivirus (AV) vendors began receiving reports of a new mass-mailing email worm, generally called VBMania, which arrives with various subjects including, “Here you have.” Today, others in the press have jumped on the bandwagon and published many shrill reports [ 1 / 2 / 3 ] that describe this worm as an outbreak and suggest it has flooded inboxes worldwide. While we don’t doubt that attackers have aggressively seeded this malicious email using spamming techniques (and likely a botnet), we haven’t yet seen the worm in our own inbox. There are reports of it affecting some well known companies. However, it doesn’t seem to be as wide-spread as the big worms of the past (Nimba, etc). In fact, most antivirus (AV) companies still only rate this worm as only a medium risk. While you should make yourself, and your users, aware of this new worm, it doesn’t offer reason for panic.
Unfortunately, the lack of coordination among AV vendors’ naming conventions makes it difficult to track these worms. While the media generally refers to this as the “Here you have” worm, AV vendors have given this worm a variety of names including:
- Email-Worm.Win32.VBMania.a (Kaspersky) W32/VBMania@MM (McAfee) W32.Imsolk.B@mm (Symantec) Gen:Trojan.Heur.rm0@fnBStPoi (F-Secure) W32/Autorun-BHO (Sophos) WORM_MEYLME.B (TrendMicro) For simplicity sake, we will refer to this worm as VBMania.
Despite the media hype surrounding this new worm, it doesn’t seem to use any new techniques that would allow it spread any more quickly than a typical email worm. In fact it seems to call back to older malicious email techniques, some saying it shares similarities with the older ILoveYou and Anna Kournikova worms from 2000 and 2001. We describe some of VBMania’s distinguishing characteristics below.
VBMania arrives as an email with the following Subject lines:
Here you have
Just for you
This is The Free Dowload Sex Movies,you can find it Here.
The body of the worm contains some text describing either a document or movie. It also includes a link to what appears to be a PDF document or WMV movie file. However, if you actually click the link, it attempts to get you to download a malicious .SCR screensaver file. An example of the malicious SCR file might include:
- PDF_Document21_025542010_pdf.scr If you run the malicious .SCR file it:
Copies itself to mapped drives and removable USB media (uses AUTORUN tricks as well)
Tries to lower your computer’s security by disabling many popular security applications
Downloads and installs various malware (likely including a botnet trojan)
Steals sensitive information (including passwords from web browsers)
VBMania doesn’t really use any tricks that you haven’t seen before. You should have no problems distinguishing this worm in your inbox, and avoiding it. However, attackers seem to have spammed this worm very aggressively. If one of your users does accidentally run its malicious file, they could cause a lot of damage to your network. Make sure to inform your users of this new email worm so they know to avoid it. However, you don’t need to panic over this new threat, despite what the media may suggest.
What you can do
As always, remind your users never to open unexpected attachments or click on unexpected web links from any source. Inform them that most modern viruses falsify the “From” field and can appear to come from friends, co-workers, or other trusted parties.
Most major antivirus vendors already have signatures that detect this worm. Check with your vendor for the latest update.
Educate your users by downloading and presenting the new SecurityWise module, “E-mail Safety in the Age of Cybercrime.” This resource is available free of charge, exclusively to LiveSecurity Service subscribers.