Christmas greetings from Internet worms

14 12 2004

Several new Internet worms are spreading fast, two of them in the guise of Christmas greeting emails. One is programmed to trigger on New Year's Day.

These viruses were all discovered in the last few days and are already widely distributed. They gather email addresses from the infected computer and replicate themselves to the contacts listed there.

They all attack computers running Windows 95, Windows 98, Windows 2000, Windows Me, Windows NT, Windows Server 2003 and Windows XP.

Erkez.D sends emails that may contain a greeting such as ‘Merry Christmas!’, ‘Joyeux Noel!’, ‘Feliz Navidad!’, ‘Buon Natale!’.

It may also attempt to terminate processes, change security settings and open a backdoor to make the computer vulnerable to further attacks. It is rated as a medium/high category threat.

Atak.F sends emails that may contain a greeting such as "Merry X-Mas!" or "Happy New Year!".

Qeds sends emails that may be recognized by the Chinese characters in the Subject and in the name of the .zip attachment.

VBS.Sorpe.A behaves in a similar way to the others. It sends spoof emails purportedly from ‘support@microsoft.com’ carrying the message:

‘Service pack 2 is due soon for microsoft users, Bug fixes, Internet Explorer patches and NEW security features. Please read more from the file attcahed to this microsoft news letter.’

It is programmed to display the following message on the 01/01/2005:

Vbs.Spore@mm (c) 2004

W A R N I N G :
Your system resources is in a critical state. To avoid any damages to your system or files, Please restart your computer or contact the system administrator

VBS.Sorpe.A has a high distribution and a second variant has now been discovered.

Christmas greetings from Internet worms

Please do make sure that your Firewall and Anti-Virus programs are kept updated

These viruses can cause low to moderate damage to unprotected systems but they are all easy to contain with reputable Internet security programs.