Half an hour ago,we received a new variant of Email-Worm.Win32.Warezov(aka Stration).Like the earlier variants,it will download another variant of Warezov from “madesunjinkdieonrunhasde.com”. We advise everyone should block this domain.

The email is also like the earlier:

Subject: Mail server report
Body:
Mail server report.

Our firewall determined the e-mails containing worm copies are being sent from your computer.

Nowadays it happens from many computers, because this is a new virus type (Network Worms).

Using the new bug in the Windows, these viruses infect the computer unnoticeably. After the penetrating into the computer the virus harvests all the e-mail addresses and sends the copies of itself to these e-mail addresses

Please install updates for worm elimination and your computer restoring.

Best regards,
Customers support service

Attachment: Update-KB6031-x86.zip

The size is 7,172 bytes, packed with PE_Patch and UPack, Kaspersky detects it as Email-Worm.Win32.Warezov.ls.

Upon execution, it will download another variant of Warezov from “madesunjinkdieonrunhasde.com”. The size is 78,631 bytes, also packed with PE_Patch and UPack, Kaspersky detects it as Email-Worm.Win32.Warezov.ls.