Massenmail-Wurm mit dem Titel "Here you have" weltweit aktiv

Wurm versucht sofort, die installierte Sicherheitssoftware auszuhebeln

(14.09.10) - Ein neuer Massen-Mail-Wurm mit dem Titel "Here you have" verbreitet sich weltweit im Internet. Der Wurm gelangt via E-Mail in die Postfächer und enthält einen Link, der scheinbar auf ein PDF-Dokument verlinkt. In Wahrheit zielt dieser Link aber auf ein bösartiges Programm. McAfee hat diesen Wurm mit "medium risk", also mit mittlerer Gefahrenstufe bewertet.

Wenn der Nutzer auf diesen Link in der E-Mail klickt und damit die bösartige Software aktiviert, versucht der Wurm sofort, die installierte Sicherheitssoftware auszuhebeln und sich selbst an sämtliche auf dem PC befindlichen Kontakte des Benutzers weiterzuleiten. Das Ergebnis ist, dass die E-Mail Server von Unternehmen wegen dem hohen E-Mail- und damit dem Datenaufkommen sowie der hohen Bearbeitungsauslastung zusammenbrechen können. Mit dem Wurm infizierte E-Mails können vom Inhalt her variieren und wirken meist wie die E-Mail von einem Freund oder Bekannten. Häufig sehen diese wie folgt aus:

Betreff: Here you have

Inhalt: This is The Document I told you about, you can find it here. [link] Please check it and reply as soon as possible. Cheers, XY

McAfee Threat Alert

New "Here You Have" Worm Delivers Unwanted Gift

Global Mass Mailing Worm Masquerades as Business Message but Links to Malware

A new Internet worm dubbed "Here You Have” is streaming into worldwide inboxes, offering a dangerous payload, according to McAfee Labs. The worm, which travels via spam email with the subject line of "Here you have" or "Just for you", masquerades as a business email with a link to a PDF file. However, the email actually contains a link to a malicious program that can disable security software and send itself to all the contacts in the recipient’s address book.

Corporations around the world were particularly affected by the worm on Thursday as it clogged up their email systems. Consumers could soon be affected as they go home and log onto their machines.

For this reason, McAfee Labs has labeled the worm as a "medium" risk, and warns all computer users to delete any email with the "Here you have" subject line.

Although the dangerous link has been taken down, neutralizing the threat, it can still spread through remote machines, mapped drives and removable media, Labs warns. The Hook: You receive a spam email with the subject line "Here you have" and a link that looks like it leads to a PDF file. It may appear that the email comes from someone you know.

· The Methods: The email invites you to click on the link, and once you do it prompts you to download a file. This file is actually malware that disables the security software on your machine and sends itself to everyone listed as a contact in your address book.

· The Dangers: Once you are infected, your computer has diminished security protection. Your machine is also being used to spam your friends and contacts. If you are on a corporate network, the network could be clogged as the worm works its way through address books.

· Bottom Line: Do not click on the link in any email with the subject header "Here you have," even if it appears to be from someone you know.

Tips to Avoid Becoming a Victim:

· Never click on a link in a spam email or IM from someone you don’t know, and be suspicious of strange emails from people you do know. Their account could have been compromised.

· Use comprehensive security software to protect you from viruses, spam, and other Internet threats, and keep the software up-to-date.

· Set your operating system and browser to automatically apply updates.

(McAfee: ra)