VBS_Numgame.A arrives as an e-mail with in an attachment, generally GuessGame.html or GuessGame.vbe.
Andrew Gordon, managed services architect in Australia for anti-virus vendor Trend Micro, said it had issued a yellow alert about VBS_Numgame.A on Saturday.
As yet, Gordon said it has not had any reports of it in Australia, and believes it has mainly propagated in the US. At the time of going to press it was still unknown where the worm originated.
Gordon said that because the virus is vbs script it will access a user's address book to grab every address in it.
The payload of Numgame means that it will delete several files and folders in a recipient's c:drive and may also delete files from any network drives the user is mapped to. "It'll delete on a random basis," said Gordon. "The worm also tries to gain the user in the guessing game....so that they think it is a legitimate attachment."
Trend Micro has given the Numgame virus a yellow rating, which means it is medium risk. He said that it didn't seem to be getting out of control, which Gordon partly attributes to the weekend having allowed systems administrators to update against the virus prior to staff getting into the office this morning.
none