ZDNet UK

CNET NETWORKS UK BUSINESS SITES:
atlarge.com
BNET UK
silicon.com
SmartPlanet.com
ZDNet.co.uk

ZDNet.co.uk - Winner of Best Business Website 2007

You are here: ZDNet.co.uk > News > Security

Security threats Toolkit

'Happy New Year' worm fizzles out

Tags:
Spam

Tom Espiner ZDNet.co.uk

Published: 02 Jan 2007 12:36 GMT

Security vendors have warned that the "Happy New Year" worm could catch employees returning from New Year's celebrations unawares, but believe the threat posed by the malware will soon pass.

The worm, which was first detected last last week, is sent as an email attachment called either postcard.exe or postcard.zip. If opened, it automatically sends itself to email addresses found on an infected computer. It is also "network aware", meaning it will try to infect all computers on a network.

The worm also turns off antivirus applications, can drop more malware, downloads code from the internet, and installs itself in the registry, making it harder to detect, according to security company Sophos.

Sophos saw a large spike in the number of infected emails on 30 and 31 December, when the worm accounted for 93.6 percent of all infected email. However, over the past 24 hours the worm accounted for just 4 percent of all viruses in infected email.

Sophos said systems administrators should be aware that employees returning to work may inadvertently infect their machines if their antivirus has not yet updated.

"Not many people will have used their machines since the 30th — people are far more likely to have been sipping champagne," said Carole Thierault, senior security consultant for Sophos. "As people go to work and turn on their machines, they might open the attachment if they're cloudy from last night's celebrations, and could be at risk if their antivirus has not been updated," Thierault explained.

Sophos has called the worm Dref V, but it is also known as Trojan-Downloader.Win32.Tibs.jy. The subject line of infected emails has been "Happy New Year!", but Sophos has also seen: