Feeds

Virus experts fret over Myfip

Previously-unknown packing utility

  • alert
  • submit to reddit

Choosing a cloud hosting partner with confidence

The Myfip worm which was discovered in the wild a month ago is starting to spread, according to email security firm MessageLabs.

The worm assumes the guise of an email from a webmaster at eBay. The email asks the recipient to take part in a 'Multiple Item Auction' with the chance of winning a prize. But the worm's most worrying characteristic is its use of a previously unknown packing utility.

There are a number of different utilities available to virus authors that allow them to compress and encrypt their viruses. Inexperienced authors often use common packing programs that are readily available on the internet. With the Myfip worm, the virus writer is using what is termed a nested compression technique - meaning that the file is compressed numerous times - which serves to confuse mail scanners according to Conor Flynn, technical director at Irish security firm RITS.

"Myfip uses a packer previously unseen in email virus distribution. The use of an uncommon packer could make it more difficult for antivirus software vendors to identify and protect against the malicious code within," according to MessageLabs.

The worm, once initiated, searches an infected computer for poorly protected network drives. It then copies itself to those drives using a file tagged "Iloveyou.txt.exe". Security firm, Symantec has said that if the worm encounters password-protected drives it will attempt to log on as an administrator by using a list of common passwords.

"Antivirus vendors have issued updates to deal with this threat but it is up to individuals to download these patches independently," said Flynn, speaking with ElectricNews.Net. "Vendors have said that they will be including a code change to handle this threat in their next releases," Flynn added.

The worm, though spreading, is not exceptionally virulent at the moment. Whilst security experts have not rated Myfip as a high-level threat the way in which is it travelling - through the uncommon packer - is worrying and could be indicative of a new trend in virus writing, experts have said.

Due to the increasing number of viruses in recent times people have become more wary of opening attachments, explained Flynn. MessageLabs also cited the poorly written text in the Myfip email is using as something which should arouse suspicion in PC users.

Copyright © 2004, ENN

Related stories

80 per cent of home PCs infected - survey
Insecurity begins at home
Mac OS X rootkit surfaces

Beginner's guide to SSL certificates

More from The Register

next story
FYI: OS X Yosemite's Spotlight tells Apple EVERYTHING you're looking for
It's on by default – didn't you read the small print?
Russian hackers exploit 'Sandworm' bug 'to spy on NATO, EU PCs'
Fix imminent from Microsoft for Vista, Server 2008, other stuff
Edward who? GCHQ boss dodges Snowden topic during last speech
UK spies would rather 'walk' than do 'mass surveillance'
Microsoft pulls another dodgy patch
Redmond makes a hash of hashing add-on
'LulzSec leader Aush0k' found to be naughty boy not worthy of jail
15 months home detention leaves egg on feds' faces as they grab for more power
China is ALREADY spying on Apple iCloud users, claims watchdog
Attack harvests users' info at iPhone 6 launch
Carders punch holes through Staples
Investigation launched into East Coast stores
prev story

Whitepapers

Forging a new future with identity relationship management
Learn about ForgeRock's next generation IRM platform and how it is designed to empower CEOS's and enterprises to engage with consumers.
Cloud and hybrid-cloud data protection for VMware
Learn how quick and easy it is to configure backups and perform restores for VMware environments.
Three 1TB solid state scorchers up for grabs
Big SSDs can be expensive but think big and think free because you could be the lucky winner of one of three 1TB Samsung SSD 840 EVO drives that we’re giving away worth over £300 apiece.
Reg Reader Research: SaaS based Email and Office Productivity Tools
Read this Reg reader report which provides advice and guidance for SMBs towards the use of SaaS based email and Office productivity tools.
Security for virtualized datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.