Crog (also known by several other names, such as Sumom, Serflog, and Fatso - the last name which is likely to become the media name) is an MSN Messenger worm that appeared today and is spreading quickly, earning Medium risk from some antivirus companies. The worm sends itself to victims via MSN Messenger from the infected computer. File names are likely to end in a .pif extension, but there is a 1-in-12 chance that the extension will instead be .scr. Most of the file names infer a photograph, either humorous or pornographic in nature.
Crog has been declared a Medium Risk threat at Sophos, Trend Micro, and Secunia.
Details
Crog was discovered on March 7, 2005, with details first published shortly after midnight GMT. It is a worm that spreads via MSN Messenger and the eMule P2P network. Additionally, machines infected with Crog will have their security settings adjusted to lower levels. Access to security related web sites is blocked on Crog-infected computers, and a range of security programs also is disabled by the worm. The worm also intercepts CD writes and adds itself to them - this is an uncommon feature in worms.
Protection
Updated detections for most antivirus programs should appear within the next 24 hours or so. It is unlikely emergency detection will be published, as the worm reminds a Low risk threat on all descriptions at this time. In the meantime, MSN Messenger users should exercise common sense and not open any executable file format that is sent to them randomly, including .pif and .scr, which this worm uses.
Infected users should wait for detection files and/or more detailed information and removal information to be published before attempting to remove the worm. Until then, infected users should avoid connecting to the Internet or any open network.
Links
McAfeeHelp Forums - Excellent resource for latest information and updates.
Secunia - Compiles latest descriptions and links. Refers to worm as “Fatso.“
Trend Micro - Excellent, highly detailed write-up with pictures. Refers to worm as “Fatso.”
Symantec - Fairly detailed write-up without some additional details. Uncluttered. Refers to worm as “Serflog.”
Panda - Fairly detailed write-up. Excellent removal instructions. Refers to worm as “Fatso.“
F-Secure - Fairly detailed write-up. No removal instructions. Refers to worm as “Sumom.“
McAfee - Fairly detailed write-up. No removal instructions.
Sophos - Fairly detailed write-up. No removal instructions. Refers to worm as “Sumom.”
Posted
Mar 07 2005, 03:38 PM
by
trafton