Email Worm Claims Missile Strike Against Iran

An email worm began circulating today claiming the U.S. has launched missile strikes against the country of Iran. The email carries an executable attachment named "Read More". If opened, the email worm installs itself to your system, possibly using a rootkit to hide its files. The email subject line reads: "USA Missle Strike: Iran War just have started".

According to antivirus vendor F-Secure, other variations on the email may include executable attachments named "video" or music" and the email subject lines may also include one of the following:

"USA Just Have Started World War III"
"Missle Strike: The USA kills more then 20000 Iranian citizens"
"Israel Just Have Started World War III"

Both F-Secure and Kaspersky detect this threat as Email-Worm.Win32.Zhelatin.cq (F-Secure uses the Kaspersky engine). BitDefender and Authentium detect as Trojan.Peed.Gen and W32/Trojan.ADUB, respectively. Among other vendors, detection is low.

Email worms typically masquerade as sensational news events - and in this case, even sensational non-events. Never open email attachments received unexpectedly (regardless of source) and be particularly suspicious of those email making sensational claims. Your best bet is to tune in or browse to your favorite news site if you want to check the veracity of claims received in email.