RE: [Snort-sigs] New Worm / Virus - WORM_MIMAIL.R?

[Jim Clews <jclews () climaxgroup com>]

The "vanilla" version of this one isn't set to start the SCO DOS until the
1st Feb 2004 - the virus stops propagating on Feb 12 2004

Apologies is this makes it to the list twice - I sent the original using an
outdated SMTP address.

Nice to see this virus making it onto the snort lists too!!!

-----Original Message-----
From: sam () neuroflux com [mailto:sam () neuroflux com] 
Sent: 26 January 2004 22:48
To: Joe Stewart
Cc: sam () neuroflux com; snort-sigs () lists sourceforge net;
snort-users () lists sourceforge net
Subject: Re: [Snort-sigs] New Worm / Virus - WORM_MIMAIL.R?


Interesting.  None of our machines so far that have been infected are trying
to contact sco.com on port 80.  I'm curious if there are multiple varients??

We have identified this virus as the MyDoom/Novarg, and Symantec did confirm
our submission as such.


> On Monday 26 January 2004 4:42 pm, sam () neuroflux com wrote:
> > All:
> >
> > We are experiencing what appears to be a new varient of the MIMAIL 
> > virus. We've had several machines infected now, and I've created a 
> > quick signature:
>
> Although Mimail.Q did also come out today, what you're describing is 
> Mydoom/Novarg, which is spreading more rapidly than Mimail from the 
> looks of it. Details from the AV companies are sketchy at this point, 
> but, aside from spreading via SMTP and KaZaA, the copy I looked at 
> appears to start up 63 threads all requesting the index page of 
> www.sco.com every 300 milliseconds.
>
> -Joe
>
> --
> Joe Stewart, GCIH
> Senior Security Researcher
> LURHQ http://www.lurhq.com/



-------------------------------------------------------
The SF.Net email is sponsored by EclipseCon 2004
Premiere Conference on Open Tools Development and Integration See the
breadth of Eclipse activity. February 3-5 in Anaheim, CA.
http://www.eclipsecon.org/osdn
_______________________________________________
Snort-sigs mailing list
Snort-sigs () lists sourceforge net
https://lists.sourceforge.net/lists/listinfo/snort-sigs


-------------------------------------------------------
The SF.Net email is sponsored by EclipseCon 2004
Premiere Conference on Open Tools Development and Integration
See the breadth of Eclipse activity. February 3-5 in Anaheim, CA.
http://www.eclipsecon.org/osdn
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users