Old-fashioned email worm starts to spread

Security firms are warning of an old-style worm transferred via email that is spreading rapidly in the wild.

The malware uses email attachments with the subject line 'Here you have', and contains a .scr file disguised as a PDF.

The email asks the recipient to check the contents, which activates the malware. The attack has spread quickly, with a reported 60,000 infections including outbreaks at ABC/Disney, Google, Coca-Cola and Nasa.

"The .scr when executed downloads a number of additional tools, one of which appears to attempt to check in with a potential controller," said Marcus Sachs, director of the SANS Institute, in a security advisory.

"The malware attempts to deactivate most anti-virus packages, and uses the infected user's Outlook to send out its spam."

Security firm McAfee said in a blog post that the malware installs an application named CSRSS.EXE on the infected machine, and then uses email, accessible remote machines, mapped drives and removable media to send itself on.

It also installs UPX packed password recovery tools (ChromePass, OperaPassview), a UPX packed Sysinternals tool (PSExec) and a malicious HOSTS file.

The term 'here you have virus email' has become a top 10 Google search, and such an old-fashioned attack seems to have caught many unguarded.

"US-CERT has received multiple reports from a number of federal agencies and private sector entities experiencing an email worm," said Department of Homeland Security press secretary Amy Kudwa in a statement.

"US-CERT is in the process of collecting and analysing samples of the malware, and has developed and disseminated mitigation strategies."

Malware spreading via email attachments was common a decade ago, but professional malware distributors do not use such tactics today.

The huge amount of network traffic such worms generate makes them easy to spot, and signature tags by security companies alert IT departments that something is wrong. All major security vendors are now blocking the worm.