----- Original Message ----- From: "Trend Micro Newsletters Editor" <[EMAIL PROTECTED]> To: <[EMAIL PROTECTED]> Sent: Wednesday, May 11, 2005 4:43 PM Subject: Trend Micro Medium Risk Virus Alert - WORM_WURMARK.J
Dear Trend Micro customer, As of May 11, 2005 4:30 AM (Pacific Daylight Time/GMT -8:00), TrendLabs has declared a Medium Risk Virus Alert to control the spread of WORM_WURMARK.J. TrendLabs has received several infection reports indicating that this malware is spreading in France, India, Taiwan, and Singapore. This memory-resident worm propagates via email messages. Upon execution, it drops a copy of itself in the Windows system folder using a random file name. It also drops a randomly named (Dynamic Link Library) DLL file in the Windows system folder, which is a component of <I>IESpy</u>, a spyware program. This worm has a keylogging capability. It saves the logs typed by the user in a dropped random DLL file. It drops several .ZIP files in the Windows system folder as email attachment. This worm propagates by sending a copy of itself via email. The email message contains the following details: Subject: (any of the following) -details -girls -image -love -message -music -news -photo -pic -readme -resume -screensaver -song -video Attachment: (any of the following file names) -details.zip -girls.zip -image.zip -love.zip -message.zip -music.zip -news.zip -photo.zip -pic.zip -readme.zip -resume.zip -screensaver.zip -song.zip -video.zip TrendLabs will be releasing the following EPS deliverables: TMCM Outbreak Prevention Policy - 174 (uploaded) Official Pattern Release - 2.625.00 Damage Cleanup Template - 596 For more information on WORM_WURMARK.J, you can visit our Web site at: http://www.trendmicro.com/vinfo/virusencyclo/default5.asp?VName=WORM_WURMARK.J You can modify subscription settings for Trend Micro newsletters at: http://www.trendmicro.com/subscriptions/default.asp ----------------------------------------------o0o---- IMPORTANT NOTE! TrendLabs will also be releasing a corresponding 3-digit pattern file (995) to the pattern indicated in this email. This 3-digit pattern is a special release for users running non-NPF compliant products (i.e., old 3-digit pattern format) and is designed to provide protection against the most current malware threats. Users running non-NPF compliant products are still urged to apply the NPF solution at http://www.trendmicro.com/en/support/npf/overview.htm. These users may also upgrade to the latest product version. Only NPF-compliant products will be able to update with regular pattern releases. ______________________________________________________________________ This message was sent by Trend Micro's Newsletters Editor using Responsys Interact (TM). To unsubscribe from Trend Micro's Newsletters Editor: http://trendnewsletter.rsc03.net/servlet/optout?mgLDYCCDUElLHFlPpigLmDlLE0 To update your subscription preference, or to change your email address: http://trendnewsletter.rsc03.net/servlet/website/PersonalizedForm?mgLEwkLMLkLgJL9LgmLk.40hktELtHpsElLHFlPpigLmDlLEhE3vyf_31yf7yd_c_z18z To view our permission marketing policy: http://www.rsvp0.net Copyright 1989-2005 Trend Micro, Inc. All rights reserved Trend Micro, Inc., 10101 N. De Anza Blvd., Suite 200, Cupertino, CA 95014 ------------------------ Yahoo! Groups Sponsor --------------------~--> Give the gift of life to a sick child. Support St. Jude Children's Research Hospital's 'Thanks & Giving.' http://us.click.yahoo.com/lGEjbB/6WnJAA/E2hLAA/BRUplB/TM --------------------------------------------------------------------~-> *************************************************************************** Berdikusi dg Santun & Elegan, dg Semangat Persahabatan. Menuju Indonesia yg Lebih Baik, in Commonality & Shared Destiny. www.ppi-india.org *************************************************************************** __________________________________________________________________________ Mohon Perhatian: 1. Harap tdk. memposting/reply yg menyinggung SARA (kecuali sbg otokritik) 2. Pesan yg akan direply harap dihapus, kecuali yg akan dikomentari. 3. Lihat arsip sebelumnya, www.ppi-india.da.ru; 4. Satu email perhari: [EMAIL PROTECTED] 5. No-email/web only: [EMAIL PROTECTED] 6. kembali menerima email: [EMAIL PROTECTED] Yahoo! Groups Links <*> To visit your group on the web, go to: http://groups.yahoo.com/group/ppiindia/ <*> To unsubscribe from this group, send an email to: [EMAIL PROTECTED] <*> Your use of Yahoo! Groups is subject to: http://docs.yahoo.com/info/terms/
