The Hindu Business Line : `Warezov virus variant is back'

It's been a while since the last attack of the Warezov gang. But it seems now, they're back in action. Warezov is largely to blame for the massive increase in spam amounts and spreads by using a zip file attachment, which contains an executable file that uses a text file icon as a decoy.

It has been observed that Warezov infected machines download additional components which, after a slight delay, start reeling out spam messages. And the peculiarity is that these spams are pharmaceutical spams, especially advertising for viagra, valium etc.

Talking to Business Line, Mr Patrick Runald, Senior Security Specialist, F-Secure Security Labs, said the domain names they are using are registered in China, typically in Beijing or Shanghai. The first version of Warezov was discovered on August 16, 2006, and since then there has been 269 different variants.

"The clear objective of the Warezov gang is spamming, there is a clear link between domains that have been used by the malware and domains that have been used in spamming. We started closely following the Warezov worm after the first variants were found," he points out.

Reappearance

But why has it reappeared? Mr Patrick notes that "one reason could be that they feel that they need to increase the size of their botnet after people have removed earlier variants of the malware. Another could be that the same gang, has in fact been busy releasing other pieces of malware that we name differently, where there is no obvious connection."

Mr Patrick notes that the different Warezov variants have so far affected thousands of people across the globe. The latest variant,W32/Warezov.NF. is not as bad as the earlier ones, but this has also affected a few thousand people, he added.