SCI/TECH: Worm Masquerades as Antiporn Tool

A new worm that comes in an email claiming to be an anti-porn tool is currently circulating. The worm has been named W32/Baba-C by antivirus vendor Sophos. The worm is in the early stages, but has the potential to spread.



I guess the word of caution here should be that you never click anything that comes in an email whose sender you don't know. When I had my email account with WebTV, it was not uncommon to get spam from myself or others in my address book. Fortunately, WebTV is immune to malware. I haven't had any such experiences with my computer.

Computer virus experts at Sophos have identified that a new mass-mailing worm may have a link to a university based in South Korea.

The W32/Baba worm distributes itself via email claiming to be an mail delivery error message, but if users click on the attached file the virus will infect the PC and try to forward itself to other email addresses found on the computer.

Hidden inside the worm are the phrases "SoonChunHyang" and "Bucheon", which do not get displayed. The text references the SoonChunHyang University located in Bucheon, South Korea.

"It's curious that the author of this virus has hidden these phrases deep within his code," said Graham Cluley, senior technology consultant for Sophos. "In the past, virus writers have found it hard not to leave messages inside their code - often revealing clues as to the possible origin of their creations. Regardless of the reason why the virus writer did this, all computer users should ensure they are protected against the latest email threats."

Although some anti-virus vendors reported that this virus was a variant of the Netsky worm, it bears no relation to that family of worms.

Source: www.sophos.com...

The best advice for this one is to have a real virus scanner and current DAT files. This virus was discovered in October 04 so if you have say McAfee or Norton with current DAT files you don't really have much to be worried about.

If you don't have current DATs well... this is probably the least of what you have on your system.

Right click your virus scanner's icon in the system tray (near the little clock) and look at the properties, it will tell you when your files were last updated. If the date is more than like a week old, you may have a problem.

EDIT: Oops didn't see this was Baba.C. Baba.A was around in October. Well my McAfee is now last updated 1/19/05 most likely to reflect this, so it goes to prove my point about keeping updated. You'll save yourself lots of money and time!! Incidentally, AOL 9.0 now has McAfee packaged with it for free, so there's less excuses to not have current files. Do it.

[edit on 1-19-2005 by Djarums]

I check for new virus definitions from Norton daily and virtually daily there is a file to download. Anyone who doesn't run a good anti-virus software and a firewall is crazy, in my book.