I know that when malware is released for OS X, it never counts for reasons that are typically made up within minutes of the malware being released. I'm pretty sure that one of the reasons that was made up is that malware doesn't count if the user has to download and run the malware, which the user has to do in this case. And if the user is running a Windows OS that was built within the last 4 years, they would even be prompted for privilege escalation (or the malware would fail to copy itself into the Windows System directory).
So using Apple zealot logic, this one doesn't count. Or does it?
Cue the double standards...
Anti-malware companies are tracking a new “download-and-run” e-mail worm squirming through inboxes around the world.
The worm, which uses the subject line “here you have” and random text like “This is The Free Dowload Sex Movies,you can find it Here,” includes a link to what purports to be a PDF document but is instead an executable file hosted on a Web site.
If a user clicks on the link and runs the file, the machine gets infected and continues the propagation routine.
McAfee explains:
When run, the virus installs itself to the Windows directory as CSRSS.EXE (not to be confused with the valid CSRSS.EXE file within the Windows System directory). Once infected the worm attempts to send the aforementioned message to email address book recipients. It can also spread through accessible remote machines, mapped drives, and removable media via Autorun replication.
“In spite of this primitive propagation routine, the worm is pretty active, and currently sending out significant amounts of mail,” says Alexander Gostev, a security researcher at Kaspersky Lab (see disclosure).
UPDATE: I’ve confirmed that the website hosting all the malicious worm files has been deleted, meaning the worm has effectively been killed. Keep in mind, however, that an infected computer will continue to spew e-mails until it is cleaned.
My colleagues have found evidence of this worm squirming since early August. Here is a Microsoft malware alert dating back to August 4, 2010. This Symantec virus description also shows the e-mail threat was in circulation last month.
* Image via Securelist.com.
