WORM_RASTY.A has a high distribution potential

Nov 28, 2007 15:33 GMT  ·  By

A new threat was discovered by security vendor Trend Micro which said WORM_RASTY.A affects most versions of the Windows operating system. According to the company, the worm can infect Windows 98, ME, NT, 2000, XP and Server 2003 and can be downloaded from malicious websites without users' approval. In addition, it could be dropped by some other malware files on a vulnerable system. Although we saw lots of similar infections that attempt to spread via removable drives, the interesting aspect of WORM_RASTY.A is that it has a high distribution potential bundled with a medium damage potential.

Just as I said, the worm attempts to infect the clean removable drives connected to the computer and install on a new system once the connection is established. Moreover, it hides all the removable device content and uses the Windows folder icon to trick the users and make them believe it is a common file.

"Upon execution, this worm drops copies of itself. It then creates and modifes several registry keys/entries," Trend Micro wrote in the advisory.

"This worm propagates by dropping a copy of itself in all removable drives. It hides any folder found in the said drives and then creates copies of itself using the drive's original folder names as its file name. It uses the default folder icon to trick the user into believing that it is a non-malicious file."

According to the statistics provided by the security company, lots of North American computers were already affected with the worm as no less than 2,922 systems were reported as being infected with WORM_RASTY.A.

Although I'm sure you know how to protect your computer from these threats, you're advised to keep the antivirus technologies patched and updated and avoid visiting malicious links coming from untrusted sources.