Pages: 1
Worm masquerading as IE Version7 download
(Click here to view the original thread with full colors/images)
Posted by: forwardone
E-mails display an image that invites users to download a beta of a new version of Internet Explorer 7, but instead they are hit with the Grum-A worm.
A security company issued a warning Friday about a widespread attack that's masquerading as an offer from Microsoft to download a version of Internet Explorer 7.
The e-mails, which claim to come from admin@microsoft.com and have the subject line "Internet Explorer 7 Downloads," display an image that invites users to download beta 2 of Internet Explorer 7, according to an advisory from Sophos, a security company. Users who make the mistake of clicking on the link in the message, though, instead are infected by the W32/Grum-A worm.
"Worms like this are only succeeding in spreading because so many people have still not learned to be suspicious of unsolicited e-mails, even if they claim to come from well-known companies like Microsoft," said Graham Cluley, senior technology consultant for Sophos, in a written statement. "The problem is that to the casual observer the e-mail looks genuine, and the image displayed looks near-identical to the imagery that Microsoft is using on its Web site to promote Internet Explorer 7.0. Clicking on the image, however, doesn't download the real beta, but malicious code straight from the hackers."
The Grum worm is an appender virus that infects executable files referenced by Run keys in the Windows Registry. When activated, it copies itself to \winlogon.exe and makes changes to the Registry. It also edits the HOSTS file, ********* a thread into system.dll and attempts to patch two system files.
Cluley noted in the advisory that it's an old trick for hackers to mask their attacks as communications from Microsoft. In 2003, the Gibe-F worm, which also was known as Swen, was disguised as a critical Microsoft security update, and in 2005, hackers directed duped users to a bogus and malicious Web site masquerading as a Microsoft update page.
Posted by: golddust
I think these goons spamming to spread viruses need to get with the latest product; at least they could send out invites to downloads for MSN's Vista. IE 7 is old news.http://s35.photobucket.com/albums/d...leys/th_DOh.gif
Posted by: Pete Berg
Thanks a lot friend you have sent a good thing for us...i also have a look toward this and i found it more beneficial to me..it makes my pc out of any kind of worms and other viruses which made my pc like a slow speed device ...have you got any idea that how to manage all over security ..do you have something for that?