Re: New Worm in the wild

[malware () t-online de (Michael Mueller)]

Hi dbtrino,

you wrote:
> we see a lot of ping traffic and have a lot of users who report of mails
> with attachements ~74KB which have not been send by the 'sender'.

The ping traffic might be caused by a worm name W32/Nachi by NAI. See
http://vil.nai.com/vil/content/v_100559.htm .
It does use the DCOM RPC hole and a flaw in IIS/5.0 as reported in
http://www.securityfocus.com/bid/7735/info/

The mails match the report of W32/Sobig.f@MM, see
http://vil.nai.com/vil/content/v_100561.htm


Michael
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html