Security Manifest : Viruses (Very Urgent)

OUTBREAK: Zotob.E (IRCBot) worm hitting unpatched systems

trafton — Tue, 16 Aug 2005 22:18:00 GMT

A new worm utilizing the MS05-039 vulnerability has became a major outbreak. More coverage upcoming.

Details
IRCBot is a fast-spreading worm affecting systems not patched for the MS05-039 vulnerability. Infected machines will reboot frequently, as well as connect to an IRC server and await further instructions

Protection
Detection of this worm, as it is an outbreak, should be released very soon, if it is not already out.

The Gist
IRCBot is an urgent outbreak and all systems should be patched that have not already been.

Links
McAfee - Write-up.

Outbreak Alert for New MyDoom Variant

trafton — Tue, 27 Jul 2004 00:01:00 GMT

BREAKING NEWS: Mydoom Variant Medium-High Risk

At 9:25 AM Pacific Time, security company Secunia released a Medium risk alert for the latest variant of the Mydoom family, which is known by various names, including MyDoom.L, MyDoom.M, MyDoom.N, MyDoom.O, and MyDoom.R. The following are various vendor's aliases for this worm:

Computer Associates: Win32.Mydoom.O
F-Secure: Mydoom.M
Network Associates: W32/Mydoom.o@MM
Panda Software: Mydoom.N
Sophos: W32/MyDoom-O
Symantec: W32.Mydoom.M@mm
Trend Micro: WORM_MYDOOM.M

Contrary to the Secunia bulletin, Panada Software's Mydoom.M is an unrelated worm.

The following are vendor risks:

Computer Associates: High (4/5)
F-Secure: Medium (2/3)
Network Associates: Medium-On-Watch (2.5/3.5)
Panda Software: High (3/4)
Sophos: Unassigned
Symantec: High (4/5)
Trend Micro: Medium (2/3)
OVERALL: Medium-High (7.3/10)

Worldwide Spread
Trend Micro reports significant spread from Germany, Singapore, and the United States, indicating that it is likely this worm has already became common in all continents.

Recognition
Email messages appear similar to the following, although may be variable:

More Information
McAfeeHelp Forums (thanks to CD)
NAI Description
Symantec Description
Trend Micro Description
Panda Software Description
F-Secure Description
Computer Associates Description
Sophos Description

Symantec Goes High on Sasser.B

trafton — Sun, 02 May 2004 16:39:00 GMT

BREAKING NEWS: Symantec Upgrades Sasser.B to HIGH (4)

Symantec has just upgraded Sasser.B to a HIGH risk (4). This is due to increased spread. The worm, which appeared yesterday, has now achieved higher spread than the original, according to Symantec.

http://www.sarc.com/avcenter/venc/data/w32.sasser.b.worm.html