Ball drops on 'Happy New Year!' worm

[Lyte]

Ball drops on 'Happy New Year!' worm
Because malware festivities know no season

December 29, 2006 (IDG News Service) -- VeriSign Inc. is warning of a new e-mail worm arriving in in-boxes with the subject "Happy New Year!"

The message, currently being spread from 160 e-mail domains, requires users to click on the attached "postcard.exe" file in order to cause damage. The file will install several different malicious code variants, including Tibs, Nwar, Banwarum and Glowa, on the computer. It then executes mass mailings from the infected computer.

The worm is already being heavily spammed, VeriSign said. The security company has found one network that is sending out five e-mails per second with the worm.

While the worm requires user interaction to do harm, VeriSign believes that it has the potential to do damage because of the "Happy New Year!" subject line. The company is warning e-mail users to be wary before clicking on messages that they think may be legitimate happy new year messages from friends.

As of Thursday, multiple large networks have reported interceptions of the e-mail, VeriSign said. While the postcard.exe attachment has the same name as an attack spread earlier this month, this is a new and largely undetected threat, the company said.

More...