New Download.Ject worm variant has surfaced

  A new Download.Ject worm variant has surfaced. Installing either MS04-025 or XP SP2 provides protection from this security vulnerability

StartPage-EU
http://vil.nai.com/vil/content/v_127691.htm

ComputerWorld Article
http://www.computerworld.com/securitytopics/security/virus/story/0,10801,95387,00.html

AUGUST 20, 2004 (IDG NEWS SERVICE) - Users who have not yet installed the three out-of-cycle patches contained in Microsoft Corp.'s July 30 security bulletin MS04-25 now have another reason to do so immediately.

A new version of a worm called Download.Ject takes advantage of one of the flaws fixed by the patches and has begun circulating online, according to Thor Larholm, a researcher at PivX Solutions Inc.

Like its predecessor, the new version of Dowload.Ject infects vulnerable systems with a Trojan horse and a keystroke logger. But unlike the original worm, which was designed to capture sensitive information such as credit card numbers and ATM codes from infected systems, the new worm generates pop-up advertisements to pornographic sites, Larholm said.

The worm also changes the Web home page and the Internet Explorer search pane on infected systems, Larholm said. A user's regular home page is replaced with a site called TargetSearch and several browser windows with adult advertisements and links to adult sites, a PivX advisory said.

"The worm is still using the same vulnerabilities and the same attack vectors" as its predecessor, Larholm said. Those who have already installed the recently released Service Pack 2 for Windows XP or the patches contained in MS04-25 should be safe.