''This has a pretty damaging payload,'' says Steve Sundermeier, a vice president at Medina, Ohio-based Central Command. ''It's designed to wipe out pretty much everything associated with Microsoft Office... But no, we're not freaking out about this. It's out there and it will definitely affect some people but a high-risk? No.''
And Sundermeier says it's not a high-risk worm simply because protections and anti-virus signatures for it have been in place for several weeks now, giving administrators plenty of time to brace for the Feb. 3 trigger date.
''I guess we'll see what happens but protections exist out there,'' says Gregg Mastoras, a senior security analyst for Sophos, Inc., an anti-virus and anti-spam company based in Lynnfield, Mass. ''I'm not very nervous about it. I'm just looking at the amount of people who have claimed that they're infected with it and looking at our capture rate -- it's all pretty low. I just don't think it's wide-spread at this point.''
The worm in question goes by many different names. Despite anti-virus vendors' recent efforts to use common names for new malware, the Kama Sutra worm is known as Nyxem-D, Grew-A, Casper-A, Killav, Blackmal, Mywife-D and Worm.p2p.vb.cil.
No matter what it's called, the worm spreads in an attachment via email, using a variety of pornographic disguises. If the attachment is opened and the worm is launched, it immediately tries to disable a number of anti-virus and firewall products, and attempts to harvest other email addresses from the infected computer in an effort to spread itself further, according to analysts at Sophos.
But it doesn't stop there. The worm also is designed to overwrite certain files on the 3rd of every month. Ken Dunham, a senior engineer for VeriSign iDefense Intelligence based in Mountain View, Calif., notes that the worm attacks Word files, Excel, PowerPoint, Adobe Acrobat, .zip files, some database files and Photoshop.
''Instead of deleting files that could then be recovered, it overwrites them, which is one more level of deletion,'' says Dunham. ''It makes recovery a lot harder. Hopefully, people have backups and restoration processes. But in reality, a lot of people don't and if they get this worm, it could wipe out a lot of what they have on their drives.''
The worm author uses sex as the key to its social engineering trick, trying to lure users to open the attachment with subject lines like: Miss Lebanon 2006, Kama Sutra pics, and the Best Videoclip Ever.
Mastoras says IT and security administrators need to make sure their firewall protections are in place and that their anti-virus software has been udpated. Sundermeier notes that even if a computer is infected, the updated the anti-virus software will find the infection and knock it out.
The worm actually is a bit of a throwback.
Sundermeier points out that this type of worm was fairly common two to four years ago before virus writers started to try to make money off their wares. ''We used to see this time bomb a lot when they just wanted to wipe out a machine or delete files,'' he says. ''If they're looking to steal money from you, they don't want your machine down. This is a throwback.''
Loading Comments...