- MSN Worm Has A Passion For Luxury Watches
An MSN Worm appears to be in the wild which retains some of the functionality of a worm mentioned here, but with some additional features (such as sending spam, for example).
Initially, it sends the victim a message regarding Myspace (in our testing, this was the only message it sent, unlike the worm linked above which had numerous options to choose from):
Before you know it, you'll be sending lots and lots of spam - I hope your friends are looking for high quality luxury watches:
Finally, the payload drops a file onto the computer that attempts to execute remote code - it seems they're attempting to exploit victims with this.
Here's the (randomly named) file in question that causes this, deposited into your System32 Directory:
We detect this as MN.Spooler.
Research Summary Write-Up: Chris Boyd, Director of Malware Research
Technical Research: Chris Mannon, FSL Senior Threat Researcher
