Posted by: Ken Harthun
Email security, Email worm, Malware, Security, Worm
Yet another email worm has been circulating via email with the subject line “Here You Have”–an obvious misunderstanding of the English idiom “here you go” on the part of a non-native English speaking cracker. Another subject line being used is “Just For You.” Besides the text shown above, this also appears in some messages: “This is The Free Dowload Sex Movies,you can find it Here.
Here is what McAfee says about it:
When a user chooses to manually follow the hyperlink, they will be prompted to download or execute the virus. When run, the virus installs itself to the Windows directory as CSRSS.EXE (not to be confused with the valid CSRSS.EXE file within the Windows System directory). Once infected the worm attempts to send the aforementioned message to email address book recipients. It can also spread through accessible remote machines, mapped drives, and removable media via Autorun replication.
The good news is that the site hosting the malware has been taken down, effectively killing the worm. However, infected machines will still be spewing the emails, so need to be cleaned. If you suspect you or a client or family member is infected, run a malware scan on the system.