Security analysts are warning computer users about a new and potentially destructive Internet worm that can obliterate important documents. The worm, called Kama Sutra, is making the rounds now, but is scheduled to execute its first massive attack on February 3.
Detected last week, the malicious worm targets computers running Windows  and spreads primarily by copying itself to shared network locations and then sending itself to e-mail addresses found on afflicted computers. With subject lines that read "the best videoclip ever," "give me a kiss," and "school girl fantasies gone bad," the worm entices computer users to open the attached file.
"This worm feeds on people's willingness to receive salacious content on their desktop computer, but they could be putting their entire company's data at risk," said Graham Cluley, senior technology consultant at Sophos.
According to Sophos, on the third of each month, the worm will attempt to disable existing antivirus and firewall software and also will delete specific files, such as Microsoft Office documents.
Waxing or Waning Threat
The worm -- also known as Blackworm, Nyxem-D, and W32.Blackmail.E, among others -- was said by Sophos to be the most frequently sighted e-mail worm last week. Sophos statistics indicate that, within the last 24 hours alone, the worm has accounted for some 23 percent of all virus reports.
There are disagreements in the security industry about the severity of the worm, with Symantec and F-Secure taking different positions on the issue. Controversy stems from interpreting one of the worm's most intriguing features: a Web counter. Once the worm infects a new computer, it accesses a Web page on which there is a counter. The counter number increases whenever the Web page is accessed.
Andrew Jaquith, a Yankee Group senior analyst, said that most reports indicate that the counter had risen already to 700,000, which could indicate that nearly a million computers are infected.
Much of the speculation in the industry about the potential for damage done by the Kama Sutra worm centers on the counter number -- which might represent unique machines or accesses to the counter page by the same machine more than once. One of the things that is "sorely lacking" with mass outbreak malware like the Kama Sutra worm, Jaquith said, is any real sense of how many machines are compromised. (continued...)
|
