NEWS FROM THE LAB - Thursday, August 25, 2005

More PnP related malware Posted by Katrin @ 02:49 GMT

In the previous weblog entry Mikko mentioned age issues. Well, it does not matter how old we are, important is how young we feel - and we feel young :-)

However, here is the status update on PnP related malwares.

A new trojan Viran.c that uses PnP vulnerability has been spammed today, appearing to be a message from Microsoft. It disguises itself as a removal tool for Zotob and other bots.

The spammed email contains the trojan as MS05-039.exe attachment and the email subject is "What You Need to Know About the Zotob.A Worm". If you decide to search the web for more information on this text, the first hit is Microsoft's page about the Zotob incident last week.

In addition several new PnP related worms have been found.

PS. We saw another fake MS05-039 Microsoft message already in June - two months before this patch was released.