Shockwave worm gets in to local firms

The Prolin Shockwave email worm -- which poses as a Shockwave movie - swept through the country's PCs yesterday, but failed to penetrate the way this year's Love Letter virus did.

The Prolin Shockwave email worm – which poses as a Shockwave movie - swept through the country's PCs yesterday, but failed to penetrate the way this year's Love Letter virus did.

A number of local companies, including Xtra and SupplyNet were infected by the virus, which uses Microsoft Outlook to propogate.

Symantec country manager Richard Batchelor said last night the infestation was "getting up into the higher regions of something like the Love Bug, and its distribution is certainly high, because its propogator is Outlook. Once it's inside an organisation and someone's opened it, that's all it takes.

"I think people have become a bit more lax on it," said Batchelar.

IT journalists got a good look at the worm yesterday, as they received multiple copies of messages headed 'Check out this new flash movie that I downloaded just now ... It's Great Bye' from Xtra's communications department and, ironically, Symantec's own PR company.

Prolin doesn't destroy files on a user's computer but renames all files of the ".jpeg" and ".zip" type and moves them to the PC's root directory. It also writes a new text file urging the user to change to Linux and sends a message to its author with the message "got yet another idiot".

Xtra spokesperson Mary Parker says the worm is now being filter by Xtra.

Meanwhile, the Hybris worm, which has been seen here as a messzage with the subject line 'Snowhite and the Seven Dwarfs - The REAL story!' appears to have been accelerated by a collision with a spamware CD.

Local spamtracker Alan Brown says his "spamtrap" email addresses have captured more than 200 instances of the worm. It appears that the infection has struck a user of the 'Millions' CD which functions as an address book of literally millions of email addresses for use in sending unsolicited mail. Brown says the worm's ability to mutate is of concern.

"I've had it turn up in Spanish this morning. It's mutating rapidly in terms of the names that are being used. At the moment it's still using the Snow White subject line but I don't know how long that will last. It was originally thought to be a fairly simply worm and was regarded as low risk, but it's getting out of hand real fast.

"And because it uses the null sender, it's very difficult to filter."

Join the newsletter!

Error: Please check your email address.

Tags shockwave virus

Show Comments
[]