Alert
Prepared by the Internet Crime Complaint Center (IC3)
December 15, 2006

NEW VIRUS IDENTIFIED: WAREZOV/STRATION WORM

The FBI has become aware of a worm identified as Warezov/Stration Worm circulating as a spam email quickly and effectively across the Internet. The spam email claims the email recipient's computer/IP address has been identified for malicious activity online. An attachment to the email is purportedly a software used to clean the recipient's machine. This attached executable is the Trojan downloader portion of the worm itself.

A worm is identified as a program that duplicates itself over a computer network and typically performs malicious actions.

This worm or virus is unique in the quickness in which it is spreading. Upon infection, a machine will download and install a number of executables. Once the executables have been installed, an infected machine will begin conducting Domain Name Service (DNS) queries to look for open mail proxies. The infected machine then begins spamming mail containing a social engineering attack along with a Stration trojan downloader attachment.

IF YOU RECEIVE A SUSPICIOUS EMAIL WITH A FILE ATTACHED, DO NOT DOWNLOAD THE ATTACHMENT ASSOCIATED WITH THE EMAIL. IF YOU RECEIVE THIS EMAIL OR AN EMAIL SIMILAR TO THIS, DELETE THE MESSAGE AND DO NOT OPEN THE ATTACHMENT.