"9-11 VIRUS" DISCOVERED: RAPIDLY SPREADING ON THE INTERNET

Hauri ^ | 4 September 2003

[Hal1950]

Hauri Anti-Virus Researchers Discover New Medium-High Level Worm Spreading Quickly Throughout Internet

A new computer virus is beginning to spread around the Internet, aimed at causing concern around the second anniversary of the September 11th terrorist attacks, according to Global Hauri, a next-generation antivirus software publisher. The "9-11 Virus" contains the headline "It's Near 911!" or a similar variation and then contains an attached file labeled "911.jpg." Users are strongly cautioned not to open the mail and the attached file. Global Hauri strongly recommends to block out this headline "It's Near 911!" for corporate IT.

A fix for this virus is available at the Global Hauri website (www.globalhauri.com).

The full name being assigned to the virus is "I-Worm.Win32.Maro.5632" although it will likely be known as the 9-11 virus because of its provocative headline.

"After a short break of consecutive and devastating virus/worm attacks over the past few weeks, a new worm has been attacking e-mail systems over the Internet," says Eric Kwon, CEO of Global Hauri and an international expert in antivirus detection and elimination. "Like previous worm viruses, the 9-11 virus collects emails lists from Microsoft Outlook in order to spread more rapidly, using the provocative headline about 9-11 to get the unsuspecting user to open the email. In this case, there also appears to be an intention of causing fear, as well as a possible political motivation."

[OPS4]

Thank you for this post.
Ops4 God Bless America!

[Brad’s Gramma]

bttt

[Dog Gone]

I didn't think a .jpg could be an executable.

[Bloody Sam Roberts]

I didn't think a .jpg could be an executable.

Most people have a file association with .jpg files on their PCs that will any one of a number of programs. How it works from there...I cannot say.

[Moose4]

They can't, unless the file is actually named something like 911.jpg.scr or 911.jpg.exe. Since most Windows systems are set up to hide file extensions by default, the .scr or .exe is hidden, so people think, "oh, a picture," and open it. That's how a lot of email viruses spread, by renaming the files to have a "fake" extension before the real one.

Maybe this one's different, or maybe this is a hoax.

}:-)4

[Bloody Sam Roberts]

"that will any one of a number of programs" = "that will open any one of a number of programs"

[HairOfTheDog]

It is just named *.jpg* with another actual extension.

[Dog Gone]

That's my understanding as well, and I'm a little surprised that this alert didn't mention that. In fact, it raises my suspicion that this isn't a real alert.

[tx_eggman]

Can't find any CURRENT references to a 911 virus at cert.org. The last reference there was in April 2000

[thoughtomator]

And as usual, Microsoft Outlook is at the center of the vulnerability.

Wonder when people are going to start taking security seriously?

[Chad Fairbanks]

Info from Symantec here:

http://securityresponse.symantec.com/avcenter/venc/data/w32.neroma@mm.html">http://securityresponse.symantec.com/avcenter/venc/data/w32.neroma@mm.html

[Chad Fairbanks]

Oops...

here

[Izzy Dunne]

According to this article, the NEROMA virus has the subject line "It's near 911!".

[CnTXBobcat]

Symantec has it posted on their site:

http://securityresponse.symantec.com/avcenter/venc/data/w32.neroma@mm.html">http://securityresponse.symantec.com/avcenter/venc/data/w32.neroma@mm.html

[Dog Gone]

Well, it seems to be real.

W32.Neroma@mm is a mass-mailing worm that attempts to use Microsoft Outlook to email itself to all the contacts in the Windows Address Book.

The email has the following characteristics:

Subject: It's Near 911!
Message: ice butt baby!
Attachment: 911.jpg

W32.Neroma@mm is written in Microsoft Visual Basic (VB) and is UPX-packed.

[lwd]

Wow, another virus that exploits ms Outlook.
surprise surprise...

[JoJo Gunn]

Mods, please remove previous post. For some reason the link is showing twice.

[Chancellor Palpatine]

Crap.