Worms on the prowl, traveling via MSN Messenger

TalkBack 22 of 67:

Next »

« Previous

• Thread View
• Flat View

You are correct

According to Aladdin, Win32.Kelvir.a spreads via a URL sent in an IM that contains an infected file. After clicking on the link, a person's computer becomes infected by the worm.

The Messenger itself is not the culprit. It looks like ActiveX once again is rearing its ugly head. One would think SP2's default setting would warn a user if something was about to be installed. Those without SP2 would have to increase their security settings to not allow automatic execution of ActiveX scripts. So obviously those who do not have IE on their systems (i.e. people who do not run Windows) are safe from spreading this.

The article does not say whether or not root access is required because it does not say where the virus installs itself. If it tries to install itself systemwide, then being non-admin would offer some protection. If it installs in user space (although that is normally rare in Windows), then it would not matter, although it would make recovery much simpler (since admin and other user accounts would be unaffected).

Posted by: Michael Kelly   Posted on: 03/08/05 You are currently: a Guest | Members login | Terms of Use

Alert moderator to an offensive message

Subscribe to this discussion via Email or RSS

SponsoredWhite Papers, Webcasts, and Downloads

• Three Steps You Need to Know to Stop Data Loss Varonis Sensitive data exposed to misuse or loss... it is the stuff of nightmares ... Download Now
• VMware Infrastructure: A Guide to Bottom-Line Benefits VMware Frustrated by the costs of maintain ever larger data centers?or building ... Download Now
• Building the Virtualized Enterprise with VMware Infrastructure VMware VMware virtualization software has been adopted by over 120,000 enterprise ... Download Now