Malware: Archive: May 2004

5/28: Sdbot-BC Opens Backdoor

W32/Sdbot-BC is a worm and backdoor for the Windows platform, according to Sophos, which issued an alert Friday.

5/27: Agobot-JF Sets Up IRC Channel

W32/Agobot-JF is an IRC backdoor Trojan and network worm that establishes an IRC channel to a remote server in order to grant an intruder access to the compromised machine, according to Sophos, which issued an alert Thursday.

Korgo Worm Targets LSASS Flaw

The detection of a new network worm is a clear indication that users have still not applied Microsoft's MS04-011 update.

Trojan/Worm Exploits Vulnerabilities Left By Mydoom Worms

Sophos Wednesday issued an alert for W32/Francette-K, a backdoor Trojan and a worm that attempts to spread by exploiting vulnerabilties and backdoors left by members of the W32/Mydoom family of worms.

Ballmer Beats Security Drum

Amidst security-centric assurances from CEO Steve Ballmer, Microsoft releases an upgrade to Web Services Enhancements and details of its coming ISA Server 2004.

Worm Exploits LSASS Vulnerability to Let Attacker In

Worm_Korgo.B is a worm that propagates by exploiting the Windows LSASS vulnerability, which is a buffer overrun that allows remote code execution and enables an attacker to gain full control of the affected system.

Windows XP SP2 Inches Closer

Microsoft moves to squash some last-minute bugs and meet the deadline for a full release of the Windows security overhaul.

Trojan Sending Spam Mail

Downloader-IU is a downloading trojan known to have been spammed to many users on several occasions, according to security vendors that issued alerts Monday.

AirDefense Secures the Wireless Perimeter

In the rush to go wireless, administrators will find that they must supplement standard security measures with serious reporting and policy-enforcing products. Count AirDefense among them.

Malware Week in Review

This week's report on viruses and intrusions from Panda Software will deal with the worms Bobax.A, Bobax.B, Bobax.C, Kibuv.A and Lovgate.AF, as well as with the Trojan Ldpinch.W.

New Netsky Variant Uses SMTP Engine to Spread

Trend Micro Friday issued a medium-threat alert for Worm_Netsky.Y, a variant of the Netsky family of worms that uses its own Simple Mail Transfer Protocol (SMTP) engine to propagate via email.

CAN-SPAM Gets Mixed Reviews in Senate Testimony

Less than five months after the passage of the CAN-SPAM Act, government and industry representatives give it a mixed bag of reviews.

Spam Foes Worry New FTC Rule Not Enough

Spam foes say the FTC's new crack down on pornographic spam is a step in the right direction, but they worry that the new law will be largely ignored.

New Bobax Variants Exploiting LSASS Vulnerability to Spread

PandaLabs is reporting detection of variants B and C of the Bobax worm, two new malicious codes, which join Bobax.A, discovered earlier this week.

FTC Requires Warning Labels on Pornographic Spam

The Federal Trace Commission Wednesday passed a rule calling for all pornographic spam to carry a warning label.

Symantec Eyes Enterprise with Brightmail Buy

Symantec Corp., a giant in the information security space, bought anti-spam leader Brightmail Inc. on Wednesday in a bid to take a bigger bite out of the enterprise.

Your Data is Your Business -- Protect It

If you run your business without a data backup plan, you're playing with fire. Learn the first steps you can take to safeguard your business.

Netsky-P Tops the Malware Charts

Netsky-P rose from seventh place last month to first place this month in at least one list of most damaging malware.

Netsky-D Becomes Major Threat

The Netsky-D variant has been causing major problems around the world since it picked up speed and ferocity in March.

Netsky-C Hammers U.S. and U.K.

Netsky-C, categorized as a highly dangerous virus, is pounding away at networks in the United States and the United Kingdom.

Netsky-B in Top Spot for Second Month

For the second month in a row, Netsky-B was ranked as the second highest virus threat by several anti-virus vendors.

Klez-H Hits U.S. Hard

The H-variant of the Klez family of viruses has hit the United States particularly hard.

5/19: Agobot-IK Sets Up Backdoor

W32/Agobot-IK is a backdoor Trojan that allows a malicious user remote access to an infected computer, according to Sophos, which issued an alert Wednesday.

Outlook 2003 Bypass Flaw Reported

Researchers warn of a bug in Microsoft Outlook 2003 that could allow malicious hackers to perform illegal actions through e-mails.

5/18: Bobax-A Exploits LSASS Vulnerability

Security vendors Tuesday issued a low-level threat alert for Bobax.A, a worm that spreads via the Internet by exploiting the LSASS vulnerability in remote computers.

Scanning at the Point of Entry

Security software provider Perfigo says its new component can help prevent infections on the network caused by mobile workers returning home with a worm or virus.

IT Survival: Asset Management and Disaster Recovery

Mike Houghton explores how proper asset management and a comprehensive disaster preparedness plan can save administrators time, money and their sanity.

5/17: Krisworm-C Works With MIRC Client

RC/Krisworm-C is a worm used in conjunction with an MIRC client to allow remote access to the host computer, according to Sophos, which issued an alert Monday.

Malware Week in Review

This week's report from security vendor Panda Software on viruses and intrusions will deal with five worms: Sasser.F, Cycle.A, Bagle.AC, Sober.G and Wallon.A, and Qhost.gen.

5/14: StartPa-AE Changes IE Settings

Troj/StartPa-AE changes browser settings for Microsoft Internet Explorer each time Windows is started, according to Sophos, which issued an alert Friday.

802.11 Has DoS Vulnerability

Wi-Fi networks -- mainly those based on the 802.11b standard-- are allegedly vulnerable to traffic disrupting attacks according to a new report.

5/13: Sdbot-IK Spreads to Network Shares

W32/Sdbot-IK is a worm that attempts to spread to remote network shares, according to Sophos, which issued an alert Thursday.

Survey Says: Businesses Don't Update Spam Filters

When's the last time you updated your company's anti-spam software? If you're like more than a third of other business owners, the answer is never.

Bugs Found in Symantec Firewalls

Symantec Corp., one of the major security companies, announced four vulnerabilities in its client-based firewall products today.

Mass-Mailing Worm Exploits Vulnerability in Outlook Express

Trend Micro has declared a medium risk alert to control the spread of Worm_Wallon.A, a mass-mailing worm that exploits the MHTML vulnerability found on Outlook Express.

New Worm Mimics Sasser, Exploits LSASS Vulnerability

The arrest of the alleged creator of the Sasser worms has not been accompanied by a lull in the momentum of computer viruses.

MS Patches Windows Code Execution Flaw

A Help and Support Center flaw leaves Windows XP and Windows Server 2003 users are at risk of remote code execution attacks.

Analyst: Security Woes Add to Windows Cost

Gartner's John Pescatore believes enterprises must include the cost of protecting Windows when considering alternatives.

New Sasser Variant Appears, Creator of Virus Arrested

Several vendors are reporting the appearance of Sasser.E, a new variant of the Sasser worm virus which, according to data gathered by Panda Software, is affecting computers all over the world.

Hopes High Sasser Author Arrest Ends 'Worm War'

Analysts are hoping that last Friday's arrest of the alleged author of the virulent Sasser worm will put an end to the 'worm war' that has been hammering anti-virus vendors and IT shops for the past several months.

Malware Week in Review

This week's virus activity has centered around the epidemic caused by the appearance of four variants of the Sasser worm.

New Bagle Variant Spreads Via Email, Network Shares

Trend Micro Friday issued a medium-level threat alert for Worm_Bagle.Z, a memory-resident worm that spreads via email and network shares.

'Critical' Buffer Overflow Found in Eudora

Users of the venerable e-mail client are at risk of buffer overflows.

Worm Exploits Several Windows Vulnerabilities

Symantec Thursday issued an alert for W32.Welchia.K a worm that spreads by exploiting Windows vulnerabilities.

MS to Help Zap Worms Automatically

Microsoft is working on a plan to distribute worm removal tools within automatic updates by the end of this year.

Under the Radar: IM Emerging as a Stealth Threat

Instant messaging has moved out of your kid's bedroom and into the office next door. And this could spell trouble for your network security administrator. First, though, they have to know it's there -- and many don't.

Worm Tries to Disguise Itself as Excel Spreadsheet File

W32/Famus-A is a mass mailing worm for the Windows platform that copies itself to the system folder as the file PentagonSecret.xls.exe, where the second extension is several white space characters after the first, in an attempt to disguise itself as a Microsoft Excel spreadsheet file.

Malware: Archive: May 2004

Topic Centers

Articles by Type

Contact Us

More Security