The first of the season's 9/11 anniversary worms has been detected by security firms, and more are likely to follow.
The worm, dubbed W32/Neroma@MM and Worm/Icebut.A by security vendors, typically shows 'Nice butt, baby!' in the email message's body, displays the subject heading 'It's Near 911!', and disguises its payload as an attachment with the .jpg extension. Although the extension may fool some people into thinking it's a digital image -- and launching the file -- it's actually an executable that installs on the infected machine.
If recipients open this attachment, Neroma will try to delete files on the 1st, 4th, 8th, 12th, 16th, 20th, 24th, and 28th day of each month. Neroma propagates by mailing itself to addresses it culls from an infected system's Microsoft Outlook address book.
Although Neroma has been characterised as a minor threat by security firms--Sophos on Friday noted in a statement that "it poses a low threat to customers who practice safe computing"--it's likely only the first of several viruses and worms that will try to spread using 9/11 as an enticement to get recipients to open attachments.
Anti-virus companies have urged users to update their definition files to protect themselves against the worm.
Copyright (c) 2003 CMP Media LLC