WORM_LEGMIR.FU propagates itself via removable drives

Jan 9, 2008 13:37 GMT  ·  By

A new worm has been spotted in the wild and, as far I can see, all the addicted gamers out there are vulnerable unless they got their computers protected. Security vendor Trend Micro writes that WORM_LEGMIR.FU affects most versions of the Microsoft operating system, including Windows 98, ME, NT, 2000, XP and Server 2003. But what's worse is not only the high distribution potential it has, but also the high damage potential that underlines the worm's ability to really harm the data stored on your computer.

Now, let's see how you can get your computer infected (I'm sure nobody wants to do that, but it's always good to know how): first of all, you should know that visiting malicious websites infected with the worm may compromise your system pretty easily. However, WORM_LEGMIR.FU can also be dropped by another malware already installed on an affected computer, so in case you didn't install an antivirus solution to defend the system, you might get this worm too.

Just like any other recent worm, it creates some new registry entries to be sure that its files are executed every time the operating system is fully loaded. In addition, it attempts to propagate itself by copying an Autorun.inf file on every removable drive connected to the computer. Every time the infected drive is connected to a new and clean system, the worm gets automatically copied on the computer and compromises its files.

I kept the most interesting info for the last part of the article, so here it is: the worm attempts to steal gaming information, like usernames and passwords, but it's not quite clear whether the details are then sent to the attacker or not. Also, Trend Micro didn't mention the name of the affected game, so extra-care is recommended in case you get infected.