Company Press Release
SOURCE: Computer Associates International, Inc.
ISLANDIA, N.Y., June 28 /PRNewswire/ -- Computer Associates International, Inc. (NYSE: CA - news) is warning eBusinesses and home-users today of Simpsons, a new simple, but highly destructive Trojan Horse that has been reported in the field. The Trojan will delete all files contained on the user's computer. All CA antivirus users are protected from this attack by CA's award-winning antivirus software InoculateIT, which will detect the presence of the Simpsons Trojan Horse.
The Trojan is contained in a self-extracting WinZip file called Simpsons.exe. The icon of the archive has been changed to appear as an install package in an attempt to lure the user to execute the file.
Once Simpsons.exe is executed, two dialog boxes are displayed. The first box informs the user that the self-extracting archive was created by a non-licensed WinZIP-Self-Extractor and it is prohibited to distribute that archive. The second box in the background is the standard WinZip copyright screen with the modified icon. The caption of that dialog box is "Win-Zip Self-Extractor [SIMPSONS.EXE]."
CA warns users not to press the OK button in the dialog box, but to turn the computer off immediately. After rebooting the system, users shouldimmediately delete the self-extracting archive.
If the user does press the OK button, two files are extracted from the archive:
Simpsons.bat
Simpsons.bmp
Simpsons.bat is automatically executed and will immediately begin to delete all files and directories on the user's system in the following order: C:, A:, B:, D:.
Simpsons.bmp is not a bitmap file, but a regular ZIP archive containing three non-malicious files (ReadMe.txt, file_id.diz and sample.exe).
"We've seen many attacks recently that have used Microsoft's VBS language, but we cannot forget that danger is packaged in many other ways -- in this case a Trojan Horse," said Simon Perry, CA vice president, security solutions. "It's very simple. On the heels of the ILOVEYOU and Stages of Life threats, we cannot stress how important it is for eBusinesses and users to protect their valuable data by using extreme caution before opening any unsolicited file."
Users can obtain the latest information on this Trojan Horse and protect their computers immediately by downloading the latest signature file of InoculateIT at http://www.ca.com/virusinfo/. CA is offering free downloads of antivirus software for personal use at http://antivirus.ca.com and encourages computer users to take advantage of this offering.
CA's InoculateIT is the premier antivirus solution for networked environments offering unmatched management and virus protection. InoculateIT is certified by the International Computer Security Association (ICSA) to detect 100% of viruses "in the wild" and ensures a network is protected against potentially damaging and costly virus incidents.
Computer Associates International, Inc. (NYSE: CA - news) the world's leading business software company, delivers the end-to-end infrastructure to enable eBusiness through innovative technology, services and education. CA has 20,000 employees worldwide and had revenue in excess of $6 billion for the fiscal year ended March 31, 2000. For more information, visit http://www.ca.com.
One Computer Associates Plaza, Islandia, NY 11749. All trademarks, trade names, service marks, and logos referenced herein belong to their respective companies.
SOURCE: Computer Associates International, Inc.
