eBay worm spreads

eBay worm spreads

Summary: The Myfip worm that was first noted in the wild over a month ago is beginning to spread, according to Messagelabs

SHARE:
TOPICS: Security
0

An email that claims to have been sent by online auction company eBay's webmaster contains a worm that attacks poorly-protected network drives

The Myfip worm was first detected more than a month ago but email security firm Messagelabs said it has noticed the worm is starting to spread. The company expects Myfip to be difficult for antivirus software to detect because it has been compressed using an uncommon packing utility.

Virus authors have a choice of different utilities to compress and encrypt their malware. Inexperienced malware coders -- 'script kiddies' -- often use one of the popular packing programs available freely on the Internet. But Messagelabs has warned that Myfip uses a packer that it has not seen before, which could indicate that the virus writer created one specially.

According to Messagelabs, "Myfip uses a packer previously unseen in email virus distribution. The use of an uncommon packer could make it more difficult for antivirus software vendors to identify and protect against the malicious code within."

Antivirus firm Symantec's Security Response site said Myfip searches an infected computer for any network directories and attempts to copy itself to those directories with a file-name "Iloveyou.txt.exe".

If the network directory is password protected, Myfip attempts to log in as the administrator using a number of common passwords, which are listed on Symantec's site.

The company reports that the worm is "easy" to remove.

Even if antivirus scanners have a problem spotting the new worm the badly worded email should make any potential victims somewhat suspicious.

Myfip arrives in an email with the subject "hi, [recipient], I'm webmaster of eBay.com, and we raise a research in our Website".

The main body of the email asks the recipient to take part in a "Multiple Item Auction" with the chance of winning a prize.

"If you're the winner of Multiple Item Auctions, you can get the following thing… 1.a notebook that worth 18000$... 2.a camara […] worth 1000$".

Munir Kotadia reported from Sydney for ZDNet Australia. For more ZDNet Australia stories, click here.

Topic: Security

Munir Kotadia

About Munir Kotadia

Munir first became involved with online publishing in 1998 when he joined ZDNet UK and later moved into print publishing as Chief Reporter for IT Week, part of ZDNet UK, a weekly trade newspaper targeted at Enterprise IT managers. He later moved back into online publishing as Senior News Reporter for ZDNet UK.

Munir was recognised as Australia's Best Technology Columnist at the 5th Annual Sun Microsystems IT Journalism Awards 2007. In the previous year he was named Best News Journalist at the Consensus IT Writers Awards.

He no longer uses his Commodore 64.

Kick off your day with ZDNet's daily email newsletter. It's the freshest tech news and opinion, served hot. Get it.

Talkback

0 comments
Log in or register to start the discussion