Valuable photos, movies and documents could be chomped through by a new mass-mailing virus.
Cata-A spreads via email and network shares. Emails arrive with Visual Basic Script attachment, Manutenzione.xls.vbs, and the subject line 'Vostro ordine' (your order) and the message 'Salve, vi mando in allegato il vostro ordine del mese precedente' (Hi, I'm sending you last month's order, attached).

If the attachment is executed, the virus copies itself locally as Manutenzione.xls.vbs and Chktsk32.vbs and sets the Registry to run it at each time the computer is started.

It then scours the address book for email addresses to which it sends itself and searches any networked drives for VBS and VBE files and appends itself to them. It also looks for JPG, HTML, MPG, HTM, DOC and AVI and replaces them with a copy of the virus, although maintains the original filename.

On 17 January, Cata-A will also turn off the keyboard and mouse.

Sophos says it is only seeing the virus in low numbers for the time being, and most of us would probably be suspicious of a foreign language email, even if we recognise the sender's email address.



Source : PCPro