Sophos warns of new dodgy email

[Alpine]

Admins at M$ gone wild


SECURITY WATCHDOG Sophos is warning of a new and widespread email based attack that poses as Microsoft offering users to trial a beta version of Explorer 7.



The emails claim to be from "admin@microsoft.com" and have "Internet Explorer 7 Downloads" as the subject line, while the body displays an image which tries to tempt readers into downloading beta 2 of IE7. Of course, once clickified, you'll get dodgy software on your box: ie7.0.exe, which is ridden with the Grum-A worm.

For those not in the know, the Grum worm infects a shedload of exe files referenced by the run keys in the Windows registry. When it runs, it duplicates and sticks itself into \winlogon.exe and tinkers with your registry. The HOSTS file is screwed around with too, and tries to patch your ntdll.dll and kernel32.dll system files. Ouchhhh. Better update, then, just in case you check your mail after one lager too many and think the Vole actually cares about you.


The INQuirer