ISLANDIA, N.Y. – Computer Associates International, Inc. is warning
eBusinesses and home users of VBS/PLAN.A WORM, a new visual basic script
(VBS) — based email Worm that spreads by
sending itself to all entries in a Microsoft Outlook address book. This
Worm
is similar to the dangerous “ILOVEYOU” Worm that recently attacked thousands
of
computers throughout the world. It has the potential to overload email
servers, which can result in denial of service. It has been seen “in the
field” and is being watched closely by CA’s antivirus security team.
The Worm arrives with the subject line: US PRESIDENT AND FBI SECRETS
=PLEASE VISIT => (http://WWW.2600.COM)<= and contains the message text VERY
JOKE...! SEE PRESIDENT AND FBI TOP SECRET PICTURES.
The Worm subject line and message can also be randomly generated text
strings. The Worm is attached to the mail with randomly generated filename
with one of the extensions from ".GIF.vbs," ".BMP.vbs" or ".JPG.vbs."
Files with the following extension .vbs, .vbe, .js, .jse, .css, .wsh,
.sct, .hta, .jpg and .jpeg will be replaced with a copy of the Worm and
extension appended with "VBS." MP3 and MP2 files will be marked "hidden"
and
a copy of the Worm will be placed using the same filename with VBS
extension.
Additionally, on September 17 VBS/PLAN.A WORM will create the message
Dedicated to my best brother=>Christiam Julian(C.J.G.S.) Att. (M.H.M. TEAM).
All network drives (mapped drived) will then be disconnected.
There is also the potential for the Worm to download three files from
Internet: macromedia32.zip, linux321.zip and linux322.zip. Users can get the
latest information on this Worm at http://www.ca.com/virusinfo/. CA is
offering free downloads of antivirus
software for personal use at http://antivirus.ca.com and encourages computer
users to take advantage of this offering.
InoculateIT is certified by the International Computer Security
Association (ICSA) to detect 100% of viruses “in the wild” and ensures a
network is protected against potentially damaging and costly virus
incidents.
InoculateIT is part of CA’s eTrust solutions, which are built on CA’s
Unicenter TNG Framework, providing a powerful, comprehensive, and integrated
solution for building, deploying and securing eBusiness. eTrust enables
eBusiness by safeguarding all mission-critical resources, from the browser
to
the mainframe. eTrust Content Inspection PE and Mail Watcher complement CA’s
recently announced enhancement to InoculateIT.
