MalwareTeks Blog

Normally when I receive Spam mail in my admin account for the site, I simply delete it; but today one particular spam mail caught my attention. Subject: Spyware Alert!, text of the message was simply AbuseReport with 2 attachments: AbuseReport.gif and patch-2135.zip.

OK, now you have my attention.

patch-2135.zip contains patch2135.exe

Using a password protected archive is a fairly common tactic for slipping Malware past email AV scanners.

Complete scanning result of “patch-2135.exe”, received in VirusTotal at 04.12.2007, 20:46:37 (CET).

Yep, Storm Worm and a new variant.

W32.Worm.Nuwar.Gen

The Subject of the email, so far, states:
“Worm Alert!”
“Worm Detected”
“Virus Alert”
“ATTN!”
“Trojan Detected!”
“Worm Activity Detected!”
“Spyware Detected!”
“Dream of You”
“Virus Activity Detected!”

There are two attachments, one being is an image with ‘panic-worded text’, and the other is a password protected zip file, whose password is revealed in the image.

The zip file names, so far:

“patch-<random 4 or 5 digit number>.zip”
“bugfix-<random 4 or 5 digit number>.zip”
“hotfix-<random 4 or 5 digit number>.zip”
“removal-<random 4 or 5 digit number>.zip”

If you have received one of these email messages and have fallen prey to their tactics and are now infected. Please see our Malware Cleaning Guide and post in our Malware Removal Forum. There is a RootKit element of this infection that will require special handling to remove.

You must be a registered member of our site; in order to post in the Forums. This is a Free service to all. Registration is simply required to keep the spam bots from flooding the site.