USB flash drive worm spreads.Sophos has discovered a worm which spreads by copying itself onto removable drives such as USB flash drives, in an attempt to spread information about AIDS and HIV HIV (Human Immunodeficiency Virus), either of two closely related retroviruses that invade T-helper lymphocytes and are responsible for AIDS. There are two types of HIV: HIV-1 and HIV-2. HIV-1 is responsible for the vast majority of AIDS in the United States. . The worm W32/LiarVBA- worm hunts for removable drives such as floppy disks and USB memory See USB drive. sticks (as well as spreading via network shares), and then creates a hidden file called autorun.inf to ensure a copy of the worm is run the next time it is connected to a Windows PC An x86-based computer that runs some version of Windows. See x86 and Windows. . Once it has infected a system it drops an HTML HTML in full HyperText Markup Language Markup language derived from SGML that is used to prepare hypertext documents. Relatively easy for nonprogrammers to master, HTML is the language used for documents on the World Wide Web. file containing a message about AIDS and HIV to the user's drive. The worm drops an HTML file containing a message about AIDS. At the bottom of the HTML file there is a marquee message in white writing on a pink background. The message which scrolls from right to left reads as follows: This file Doesn't make harmful change to your computer. This File is NOT DANGEROUS for your Computer and FlashDisk (USB). This File Doesn't Disturb any Data or Files on your computer and FlashDisk (USB). So Don't be affraid, and Be Happy! A scrolling message displayed at the bottom of the HTM file An alternate file extension for HTML files. HTML files originated with Unix, where Web pages are commonly identified with an .HTML extension. The .HTM is an alternate in the Windows world, because three-byte extensions (.EXE, .DOC, etc.) are so commonly used. claims that the worm causes no harm. Last month Sophos about another family of worms which targeted flash drives, changing installations of Internet Explorer to say that they were "Hacked by 1BYTE". www.sophos.com |
|
||||||||||||||
Printer friendly
Cite/link
Email
Feedback
Reader Opinion