Silly Worm Aiming to Infect USB Devices

Security vendor Sophos today released an advisory concerning W32/SillyFDC-BK, a new Worm which aims to infect the USB devices connected to the computer and spread every time the infected device is connected to a clean system. Sophos wrote the Worm attempts to install itself in the registry as it only affects the Windows operating systems. There's no other information about which versions of Microsoft's operating systems are targeted by the infection so I guess all of them are affected since it attempts to add a new registry entry. The company's security tools provide protection for W32/SillyFDC-BK since November 19 so in case you're a Sophos customer, you're fully protected against it.

The Worm continues a new trend in the IT security market where more and more infections attempt to propagate through removable drives. However, it's interesting to analyze the way they manage to hide themselves into an infected computer, W32/SillyFDC-BK being just one of the numerous examples available out there.

"When run W32/SillyFDC-BK copies itself to krag.exe and sets the following registry entry to run itself on startup:


W32/SillyFDC-BK spreads via removable shared drives by copying itself to krage.exe and creating the file autorun.inf (detected as W32/Agent-FOW). The file autorun.inf is designed to run the worm when the removable drive is connected to an uninfected computer," Sophos wrote in the security advisory rolled out today.

A worm can be easily removed with one of the numerous security solutions available on the market so it shouldn't be a problem for you to remove the infection (in case you got it). However, some of these worms have the ability to harm your data and modify the information stored on the computer (they're not good at all, d'oh).

In case you're looking to install a security technology, you can choose a tool from the ones listed on Softpedia.