[Dshield] New worm developed that spreads using Acrobat files

Parish, Sandy Sandy_Parish at mcafee.com
Tue Aug 21 20:29:12 GMT 2001

It's real, although the payload is low risk.  Check out the virus
description at http://vil.mcafee.com/dispVirus.asp?virus_k=99179.


-----Original Message-----
From: Andy Stevko [mailto:andy.stevko at usa.net]
Sent: Tuesday, August 21, 2001 11:46 AM
To: dshield at dshield.org
Subject: [Dshield] New worm developed that spreads using Acrobat files

Is this real or hype?? 

from http://www.computerworld.com/storyba/0,4125,NAV47_STO62902,00.html

The worm appeared on Tuesday morning and has been analyzed by Bernardo
Quinteros, head of the Madrid-based security firm HispaSec Sistemas and
Richard M. Smith, chief technical officer of the Denver-based Privacy
"Even considering that it is a just-created laboratory virus, this is like a
seed of an upcoming deluge of [viruses] of the same kind in PDF files, a
format considered safe up to now," said Quinteros
In order to spread itself, the virus uses Adobe Acrobat and functions of
Microsoft Corp.'s Outlook that have never been used before. According to
researchers, the worm uses Outlook to send itself hidden in a PDF file. When
opened using Acrobat, the file will launch a game that prompts the user to
click on the image of a peach. After the user clicks on the image, a Visual
Basic script is run and the virus gets activated, they said. 

Dshield mailing list
Dshield at dshield.org
To change your subscription options (or unsubscribe), see:

More information about the list mailing list