'Peachy' Mass-Mailing Worm Hides In Adobe's PDF Files
By Steven Bonisteel, Newsbytes
SUNNYVALE, CALIFORNIA, U.S.A.,
08 Aug 2001, 8:33 AM CST
Virus-hunting companies are warning users of Adobe's Portable Document Format technology to beware of a new Internet worm that can launch a mass-mailing attack after arriving in such a PDF file.
However, researchers at McAfee.com Corp., the virus-software subsidiary of Network Associates, say that the worm they are calling "Peachy" is a threat only to users of what's known as the full version of Adobe's Acrobat software - the version that can also create PDF files.
Users of the ubiquitous - and feely available - Adobe Acrobat Reader software are not affected by the worm, McAfee.com said.
The researchers said the worm is written in Microsoft's VBScript language and, once activated, seeks out Microsoft's Outlook e-mail software in an attempt to send copies of infected PDFs to contacts in a victim's address book and to addresses found in the software's various e-mail folders.
McAcfee.com said the PDF arrives attached to an e-mail message whose randomly generated subject line may contain text like "Find the peach" or "Joke." The body of the message, also randomly selected from a variety of phrases, nay contain text such as "try finding the peach" and "I don't usually send this things, but..."
The attached PDF files may have names like "peach.pdf," "joke.pdf," or "search.pdf."
Recipients who open the PDF file will see a document with the message: "You have one minute to find the peach."
Says McAfee.com: "A collage containing images of naked female buttocks is displayed, one of which is actually the image of a peach."
Users who follow the instructions to "double-click the icon to show the solution" will launch the VBScript worm.
Staff at Symantec's Anti-virus Research Center (SARC), the research arm of the company behind the Norton virus-scanning software, said in a bulletin that the distribution of "Peachy" is likely to be low because of the worm's reliance on the full version of Adobe Acrobat.
Reported by Newsbytes.com, newsbytes.com .
08:33 CST
(20010808/WIRES ONLINE, PC, BUSINESS/WORM/PHOTO)
© 2001 The Washington Post Company |
