Symantec: New mass-mailer worm poses no major risk

A new mass-mailing virus may have borrowed a trick or two from MyDoom''s infection ploy, but it is unlikely to cause widespread damage.

A new mass-mailing virus may have borrowed a trick or two from MyDoom''s infection ploy, but it is unlikely to cause widespread damage, says a senior Symantec official.

HT Image

The Evaman worm, uncovered by the security software maker on Saturday, arrives as an e-mail masked under random subject lines including "Failed Transaction", "Failure Delivery or "Returned Mail".

"Evaman looks very similar to the MyDoom virus when it comes to your inbox," said Tim Hartman, Symantec Asia-Pacific's senior technical director. To pass off as a genuine bounced message from the mail server, the e-mail body contains statements such as: "The last e-mail sent by this account could not reach intended destination. E-mail has been returned as text file attachment."

This aims to lure recipients to click on the executable attachments, which then installs a backdoor program and allows the infected PC to send the worm to more users. The virus currently affects Windows-based systems only.

For now, Evaman's targets are confined to those addresses found on Yahoo's "People Search" e-mail directory. From infected machines, the worm spreads by harvesting more e-mail addresses from this site.

Initial media reports suggest the Evaman worm could cause an e-mail epidemic rivaling MyDoom, but Hartman has since played down the severity of the new threat.

Unlike the MyDoom virus which relies on its own SMTP engine to propagate, messages containing the Evaman virus are routed through one of 15 pre-defined SMTP mail servers belonging to US-based Internet Service Providers such as Earthlink and AT&T.

According to Hartman, this tactic limits the worm's ability to spread to the masses. "Evaman attempts to send itself via a relay of SMTP servers. All of those servers have got filtering turned on," he told CNETAsia.

In addition, he said the virus was discovered early and the company had "plenty of time to guard against an outbreak. To date, Symantec has received only two reports of the Evanman worm from its customers but none of them are in Asia-Pacific.

In light of these factors, Symantec has rated the worm as a level two threat, with five being the highest. Rival Mcafee has also given the Evaman virus a low-risk label.

However, Hartman warned the number of infections could rise later today when European businesses reopen after the weekend. "We may have another spike on Tuesday when US comes on board after the Independence Day long weekend," he added.