Fake virus alert carries Braid worm

November 11, 2002

Fake email virus alert sent by a Russian antivirus company Kaspersky Labs was infected with Braid worm.

After massive attack on the company's Web server, hackers have stolen its customer list and emailed them all with a worm disguised as a company newsletter.

"We are conducting an investigation to reveal the sources of this attack and are taking the necessary measures... to ensure that this type of attack will never succeed in the future," Eugene Kaspersky, founder and head of research for the company, said in an advisory about the email.

Braid, also known by Kaspersky Labs as Bridex, hasn't spread very widely. The worm, which is a variant of the Lovebug virus, is written in Visual Basic and has its own email engine, which means that it can spread itself even if compromised computer does not have an email software such as Outlook installed.

The worm infects computers running on Windows. It creates a number of copies of itself on the hard drive then searches for email addresses and then sends itself out to them.

Kaspersky Labs reminds users that their newsletters arrive in plain text format and do not contain any attached objects. If users receive a message with attached objects – they should not open them, but submit them to Kaspersky Labs' technical support (support@kaspersky.com) for an expert evaluation.