Worm poses as iTunes

Posted on Thursday, July 21 2005 @ 1:16 CEST by Thomas De Maesschalck
Anti-virus firm Trend Micro warns a new worm posing to be an iTunes file is spreading on the Web using AOL Instant Messenger (AIM). The worm is called iTunes.exe and affects most versions of Windows, Apple's Mac OS X isn't hit by this crapware.

After opening the file it will send a message to all online contacts of the affected user, stating "this picture never gets old". Each message has a link to a URL where users download a file that appears to be a JPEG image.

It also starts downloading spyware and popups and logs the Internet sites the infected users visit.
Trend Micro also warns: "This worm has backdoor capabilities. It opens a random TCP port and connects to the Internet Relay Chat (IRC) server xyz.legi0n.net. Once connected, it joins the IRC channel #fate, where it listens for commands from a remote malicious user. It then executes these commands locally on affected machines."
More info at MacWorld




Loading Comments