Bösartiger Wurm W32.Imsolk.B@mm im Umlauf

Wurm versucht den Antivirus-Schutz auszuschalten

(14.09.10) - Ein sehr bösartiger Wurm namens W32.Imsolk.B@mm ist derzeit im Umlauf. Der Wurm wird über einen Link in E-Mails verbreitet, die auch von guten Freunden stammen können. Mit Klick auf den Link lädt sich der Wurm getarnt als PDF auf den Computer herunter. Dort versucht er unbemerkt den Antivirus-Schutz auszuschalten und verschickt an alle Kontakte im Adressbuch E-Mails mit dem gefährlichen Link.

Zudem kopiert sich der Wurm auf alle Computer im selben Netzwerk. Das Ausbreitungspotential dieses Wurms wird als sehr hoch eingeschätzt. Bei Infektion wird empfohlen, sofort alle Netzwerkverbindungen - auch zum Internet - zu kappen sowie ausgehenden E-Mail-Versand abstellen.

Symantec Threat Alert

Fast Spreading Threat Infecting Computers around the Globe

Norton Tracking New Threat Affecting Potentially Hundreds of Thousands of Computers

Symantec Security Response began actively tracking a new, malicious computer worm that spreads using a socially engineered e-mail attack. The threat arrives via an e-mail that asks the recipient to click on a link embedded in the e-mail. This link actually points to a malicious program file that is disguised as a PDF file, hosted on the Internet.

When the user clicks on this link, their computer instantly downloads and launches the malicious file. This process installs the worm onto the victim’s computer– without the user knowing! Initial analysis indicates that the worm disables many common antivirus products (but it does not successfully attack Norton/Symantec products). Once running on the computer, the threat attempts to e-mail a copy of the original email to all email addresses found in the infected user’s e-mail address book.

The threat also attempts to spread from computer to computer over the local network (to other machines on your home or office network) by copying itself to open drive shares found on other machines on the network. Once the threat copies itself to another machine, if a user even opens the folder that contains the threat on this new machine, this will launch the threat and cause it to spread further through both e-mail and over shared drives.

Threat Details: The worm uses e-mail for its initial propagation (an e-mail purporting to include a link to a requested document). Once inside corporations it can spread rapidly via shared drives and removal drives. It also attempts to spread via e-mail by gathering e-mail addresses from the compromised computer.

Once the link is followed, it proceeds to download the actual malicious threat W32.Imsolk.B@mm which infects the compromised machine.

Because of how the threat is spreading – through the use of e-mail – and due to the large volume of messages being automatically created, we have seen evidence of e-mail servers getting "clogged" with these messages, becoming overwhelmed and being brought to a standstill.

Experts/Tips: Security experts are on hand to share tips with users on how they can protect themselves from these kinds of scams, including:

· Disable network sharing and/or disconnect infected computers from the local network and Internet.

· Block outbound traffic to the domains/ IP addresses contained in the social engineered e-mail to prevent users connecting to distribution sites to download.

· Use a complete Internet security suite like Norton Internet Security 2011, which can detect and remove the threat.

(Symantec: ra)