Snort mailing list archives
RE: Re: [Snort-sigs] New Worm / Virus - WORM_MIMAIL.R?
From: "Martin Jr., D. Michael" <martinm () montevallo edu>
Date: Wed, 28 Jan 2004 13:28:13 -0600
The MyDoom/Novarg virus won't start utilizing port 80 until February 1st when it attempts the denial of service on SCO.com. (See other related email.) But that does, however, pose an interesting question... Does anyone have a signature for detected the actual infection of systems? I have seen this one: alert tcp any any -> any any (msg:"MyDoom"; content: "respresented in 7-bit ASCII"; nocase; sid: 1000569; classtype: Possible-VIRUS;) BUT, according to NAI (http://vil.nai.com/vil/content/v_100983.htm) and Symantec (http://securityresponse.symantec.com/avcenter/venc/data/w32.novarg.a@mm .html) there are many variations on the infection algorithm. This one apparently only looks for SMTP traffic with "represented in 7-bit ASCII" in the packet. Suggestions? D. Michael Martin, Jr. Network Administrator University of Montevallo -----Original Message----- From: sam () neuroflux com [mailto:sam () neuroflux com] Sent: Monday, January 26, 2004 4:48 PM To: Joe Stewart Cc: sam () neuroflux com; snort-sigs () lists sourceforge net; snort-users () lists sourceforge net Subject: [Snort-users] Re: [Snort-sigs] New Worm / Virus - WORM_MIMAIL.R? Interesting. None of our machines so far that have been infected are trying to contact sco.com on port 80. I'm curious if there are multiple varients?? We have identified this virus as the MyDoom/Novarg, and Symantec did confirm our submission as such.
On Monday 26 January 2004 4:42 pm, sam () neuroflux com wrote:All: We are experiencing what appears to be a new varient of the MIMAIL virus. We've had several machines infected now, and I've created a quick signature:Although Mimail.Q did also come out today, what you're describing is Mydoom/Novarg, which is spreading more rapidly than Mimail from the looks of it. Details from the AV companies are sketchy at this point, but, aside from spreading via SMTP and KaZaA, the copy I looked at appears to start up 63 threads all requesting the index page of www.sco.com every 300 milliseconds. -Joe -- Joe Stewart, GCIH Senior Security Researcher LURHQ http://www.lurhq.com/
------------------------------------------------------- The SF.Net email is sponsored by EclipseCon 2004 Premiere Conference on Open Tools Development and Integration See the breadth of Eclipse activity. February 3-5 in Anaheim, CA. http://www.eclipsecon.org/osdn _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users ------------------------------------------------------- The SF.Net email is sponsored by EclipseCon 2004 Premiere Conference on Open Tools Development and Integration See the breadth of Eclipse activity. February 3-5 in Anaheim, CA. http://www.eclipsecon.org/osdn _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- RE: [Snort-sigs] New Worm / Virus - WORM_MIMAIL.R? Jim Clews (Jan 27)
- <Possible follow-ups>
- RE: [Snort-sigs] New Worm / Virus - WORM_MIMAIL.R? Jim Clews (Jan 27)
- RE: Re: [Snort-sigs] New Worm / Virus - WORM_MIMAIL.R? Martin Jr., D. Michael (Jan 28)
- RE: Re: [Snort-sigs] New Worm / Virus - WORM_MIMAIL.R? SN ORT (Feb 02)