The Stratio-AN worm has been aggressively distributed by its author since the early hours of Monday morning (September 25th).

It spreads via email using a variety of disguises, including the example below which ironically poses as a warning that the recipient's computer has been determined to be infected by a worm:

Subject line:

Mail server report.

Message text:

Mail server report.
Our firewall determined the e-mails containing worm copies are being sent from your computer.
Nowadays it happens from many computers, because this is a new virus type (Network Worms).
Using the new bug in the Windows, these viruses infect the computer unnoticeably. After the penetrating into the computer the virus harvests all the e-mail addresses and sends the copies of itself to these e-mail addresses
Please install updates for worm elimination and your computer restoring.

Best regards,
Customers support service

Attached file: Update-KB7859-x86.zip which contains Update-KB7859-x86.exe

Sophos, who distributed this warning, believe that the worm is using the disguise of a security warning to play on concern about an unpatched vulnerability in Microsoft's software. As a result the perpetrators may be able to fool innocent users into rushing into running the malicious update. The lesson to learn is that you should only ever get your security patches from the vendors' official website, not from an unsolicited email.

Related links: (Open in a new window.)
www.sophos.com/pressoffice/news/articles/2006/09/stration-worm.html

View printable version (opens in new window)
Back