Assiral/Larissa Alert

infectionvectors.com

February 2005

Vectors:          Mass mail

Impact:           Low (mass mailing, disables some administrative and security)

Assiral arrives in a user’s Inbox in a familiar fashion: by displaying a subject line of “Re: LOV YA!” This trick, employed by Love Letter years ago is likely to snare a few unsuspecting people. The program attempts to spread by harvesting email addresses and sending a copy of itself to each. The text files dropped by the worm indicate that the Registry hacks it makes are an attempt to harden a machine against Bropia. The worm also attempts to reset the home page of Internet Explorer.

Another interesting turn is the inclusion of the following verse:

Greetz from LARISSA.B!

I will survive,

In this moment in time,

Your computer will crash,

So, you will be mine.

I never crash,

I never fail.

So, in this moment in time,

I will survive…

     - LARISSA AUTHOR – 5-15-05

Readers will note the use of the line “So, you will be mine” as being the same as a line from Beagle variants. Other similarities to the lines hidden in Beagle are references to “time” and “survive.”

Currently only Sophos is reporting this threat, the story can be found at: http://www.sophos.com/virusinfo/articles/assiral.html.