‘Nimda fix’ Trojan disguised as security bulletin
Don't be fooled: .exe bad; .com good
Posted in Security, 2nd October 2001 01:20 GMT
Free whitepaper – Transforming IT culture
An e-mail message claiming to come from the SecurityFocus ARIS Analyst Team and TrendMicro is being used to deliver what appears to be a Trojan horse to unsuspecting users.
Do not run this attachment. These messages do not come from TrendMicro or SecurityFocus, as a quick check of the headers will reveal.
The e-mail message comes with an executable attachment named FIX_NIMDA.exe. The name is similar to the one used by TrendMicro for their free Nimda removal tool (FIX_NIMDA.com).
Last night, SecurityFocus sent e-mails to its global distribution list to alert users of the fakery. Below is a link to an example of the false e-mail, as well as the recommended patch.
SecurityFocus will never send executable attachments claiming to be a fix to any worm or vulnerability. If you have received a similar message we would like to hear from you.
Common sense and best practices indicates that you should not execute any code that is delivered via email unless you can authenticate the source of the message.
A link to the message is given in the Incidents Mailing List Archive
here.
© 2001 SecurityFocus.com, all rights reserved.
Register Research on: Application Platforms
Secure Mobile Working
The Impact of IT Security Attitudes
The Evolving Security Landscape
The Register's Green Computing Debate
