Worm wishes you Happy New Year

nightzip SG

Worm wishes you Happy New Year
Beware the postcards of doom

By Nick Farrell: Tuesday 02 January 2007, 07:08

IF YOU are back at work today and going though the mass of email in your in tray, don't open the file marked 'postcard.exe' or 'postcard.zip' which might have been sent by someone you know.
VeriSign's iDefense Labs said that an e-mail worm disguised as a New Year's greeting is making the rounds on the Interweb.

The worm is delivered in an email with the header "Happy New Year" and contains an attachment called either postcard.exe or postcard.zip.

As you might expect, if the attachment is opened, malicious software is downloaded from the Internet which infects computers running Windows. An infected computer will look for open mail proxies and begins spamming mail to infect other computers.

Idefense Labs say that the worm is based on the Warezov Trojan horse and is spreading quite quickly.

According to News.com for some reason people are more likely to open dodgy attachments in the holiday season.

Shocked

nightzip SG

This worm wishes you a Happy New Year

Security experts warn of a Trojan horse disguised as celebratory e-mail that could turn a PC into a spamming zombie.

By Marguerite Reardon
Staff Writer, CNET News.com
Published: December 29, 2006, 9:14 AM PST

An e-mail worm disguised as a New Year's greeting is making the rounds on the Internet.

Worm-laden messages are titled "Happy New Year" and contain an attachment called either postcard.exe or postcard.zip, according to experts at VeriSign's iDefense Labs, which provides information on security flaws and exploits. If the attachment is opened, malicious software is downloaded from the Internet and can infect computers running Windows operating systems.

Once a computer is infected, it looks for open mail proxies and begins spamming mail to infect other computers. The worm is already moving quickly across the Internet, at a rate of five e-mails per second on at least one large network, according to the iDefense Labs Web site.

Security experts say that although the virus looks similar to the Warezov Trojan horse that has plagued the Internet for the past month, it is actually a new variant of the worm and has been largely undetected as of December 28. iDefense performed a triage analysis of the threat and found that more than a dozen codes were installed on a computer from several worm and Trojan horse families. More than 160 e-mail servers are used by the worm to send out spam to potential victims, the company said.

High volumes of mass e-mails are usually sent around the holidays. This year has been no different, experts say. The spike in holiday spam is largely attributed to the fact that people have been more likely to open the messages.

Consumers have been shopping online more, desperate for gift ideas. They also have been expecting electronic greeting cards from friends and family. Malicious spammers have been able to exploit this expectation by designing Trojan horses that can fool unsuspecting users.

Antivirus software maker McAfee issued several advisories over the holidays, warning customers to be wary of such Trojans. On Wednesday, it cautioned users about a malicious e-mail attachment named Christmas+Blessing-4.ppt that installs software enabling attackers to remotely access a compromised computer.

Like many Trojans, the "Happy New Year" worm is not recognized by all virus scanners, so users should be extremely cautious when opening e-mail attachments, experts say.

"The period of greatest risk is through New Year's Day, when antivirus protection is the lowest for this new threat and users are most apt to click on a holiday-related message," said Ken Dunham, director of the Rapid Response Team at iDefense Labs. "Everyone should be on guard for e-mails and other content potentially harboring malicious code during the holiday period."