| Date |
Name |
Description |
Prevention, Solution, or Fix |
| 02/16/06 |
OSX.Leap.A
More info:
Symantec
F-Secure
Network Associates
Trend Micro
Sophos
top of page
|
MacOS X 10.4:
OSX.Leap.A is a worm that spreads via the OSX iChat Messenger application. No infections have been reported across campus although this worm has received significant media attention being the first OSX worm.
If executed, the worm may cause some applications to become unstable and will spread to accounts found in the machine's iChat contact list.
According to Symantec and Trend Micro, this worm only infects OS X 10.4. See their write-ups for more details.
|
Norton Anti-Virus users: Upgrade your definition file to 02/16/2006 or later. Be sure to update your definitions as soon as possible. You can use LiveUpdate to download the latest definitions.
Try using Symantec's manual removal instructions to clean systems of this infection.
NOTE: It infects files on the Mac OS X version 10.4. The worm will execute on Intel Macs, but cannot spread to other systems from these machines. |
| 01/17/06 |
W32.Blackmal.E
More info:
Symantec
F-Secure
Network Associates
Trend Micro
Sophos
top of page
|
Win2000/XP/Server2003:
W32.Blackmal.E is a mass-mailing worm with a dangerous, delayed payload. Only a very few infections have been reported across campus.
The worm arrives via email and, if executed, will email itself to all entries found on the machine, and on the 3rd of every month (Feb 3rd, Mar 3rd, etc) it will overwrite all files with the following extensions: .doc, .xls, .ppt, .pdf, .mdb, .mde, .pps, .zip, .rar, .psd, and .dmp.
Emails generated by the worm will forge the "From:" address, and have one of several different subjects and message bodies, and attachment names.
|
Symantec Anti-Virus users: Upgrade your definition file to 01/17/2006 or later. Be sure to update your definitions as soon as possible. You can use LiveUpdate to download the latest definitions.
Symantec has released a removal tool for W32.Blackmal.E which should be sufficient to repair a system infected by this worm. If you have any trouble downloading or running the tool, follow Symantec's manual removal instructions. |
| 11/22/05 |
W32.Sober.X
More info:
Symantec
F-Secure
Network Associates
Trend Micro
Sophos
top of page
|
Win2000/XP/Server2003:
W32.Sober.X is a mass-mailing worm that has spread on campus.
The worm arrives via email (written in German or English) with a randomly named attachment, which, if executed, will email itself to all entries found on the machine and lower security settings.
Emails generated by the worm will forge the "From:" address, and have one of several different subjects and message bodies.
|
Symantec Anti-Virus users: Upgrade your definition file to 11/19/2005 or later. Be sure to update your definitions as soon as possible. You can use LiveUpdate to download the latest definitions, or you can download the PC definitions in an executable format.
Symantec has released a removal tool for W32.Sober.X which should be sufficient to repair a system infected by this worm. If you have any trouble downloading or running the tool, follow Symantec's manual removal instructions. |
| 8/18/05 |
W32.Zotob.E
More info:
Symantec
F-Secure
Network Associates
Trend Micro
Sophos
top of page
|
Win2000/XP/Server2003:
W32.Zotob.E is a network aware worm that has spread worldwide rather quickly.
The worm exploits the Windows Plug-n-Play vulnerability that was recently announced. It opens a backdoor and attempts to spread to other vulnerable machines using a complex algorithm.
|
Symantec Anti-Virus users: Upgrade your definition file to 08/16/2005 rev 25 (y) or later. Be sure to update your definitions as soon as possible. You can use LiveUpdate to download the latest definitions.
Given that the worm creates a system-level compromise, we are recommending a full system format for infected machines.
This is the only way to completely ensure network and data security after a compromise such as this. |
| 8/18/05 |
W32.Esbot.A
More info:
Symantec
F-Secure
Network Associates
Trend Micro
Sophos
top of page
|
Win2000/XP/Server2003:
W32.Esbot.A is a network aware worm that has spread worldwide rather quickly.
The worm exploits the Windows Plug-n-Play vulnerability that was recently announced. It opens a backdoor and attempts to
spread to other vulnerable machines on internal and external networks across the internet.
|
Symantec Anti-Virus users: Upgrade your definition file to 08/16/2005 or later. Be sure to update your definitions as soon as possible. You can use LiveUpdate to download the latest definitions.
Given that the worm creates a system-level compromise, we are recommending a full system format for infected machines.
This is the only way to completely ensure network and data security after a compromise such as this. |
| 8/12/05 |
W32.Beagle.CE Trojan.Tooso.L
More info:
Symantec
F-Secure
Network Associates
Trend Micro
top of page
|
Win9x/NT/ME/2000/XP:
W32.Beagle.CE, a mass mailing worm that opens a back door on TCP port 80. The worm also contains a Trojan horse, Trojan.Tooso.L, which interferes with the operation of security software by ending processes, stopping services, removing registry entries, and deleting files.
Emails generated by the worm will forge the "From:" address, have a blank Subject, and have one of the following attachments:
- Taxes.zip
- The_taxation.zip
- The_reporting_of_taxes.zip
- Work and taxes.zip
- Increase_in_the_tax.zip
- To_reduce_the_tax.zip
|
Symantec Anti-Virus users: Upgrade your definition file to 08/12/2005 or later. Be sure to update your definitions as soon as possible. Be sure to update your definitions as soon as possible. You can use LiveUpdate to download the latest definitions.
Given that the worm creates a system-level compromise, we are recommending a full system format for infected machines.
This is the only way to completely ensure network and data security after a compromise such as this. |
| 5/02/05 |
W32.Sober.O
More info:
Symantec
F-Secure
Network Associates
Trend Micro
Sophos
top of page
|
Win9x/NT/ME/2000/XP:
W32.Sober.O is a mass mailing worm that has spread worldwide rather quickly.
The worm arrives via an email message written in either German or English with a randomly named attachment, which, if executed, will email itself to all entries found on the machine.
Emails generated by the worm will forge the "From:" address, and have random subjects and message bodies.
|
Symantec Anti-Virus users: Upgrade your definition file to 05/02/2005 or later. Be sure to update your definitions as soon as possible. You can use LiveUpdate to download the latest definitions.
Symantec has released a removal tool for W32.Sober.O which is sufficient to repair a system infected by this worm. If you have any trouble downloading or running the tool, follow Symantec's manual removal instructions. |
| 2/17/05 |
W32.Mydoom.AX
More info:
Symantec
F-Secure
McAfee
Trend Micro
Sophos
top of page
|
Win9x/NT/ME/2000/XP:
W32.Mydoom.AX is a mass mailing worm that has spread worldwide and has been reported on campus.
The worm arrives via an email message with an attachment, which if executed, will open a backdoor on the infected machine. It also sends mail to addresses that it retrieves from
the infected computer. The subject,
attachment name and attachment size all vary. The From: field will be spoofed.
See the W32.Mydoom.AX page for more detailed information. |
Symantec Anti-Virus users: Upgrade your definition file to 2/16/2005 revision 24 (x) or later. Be sure to update your definitions as soon as possible. You can use LiveUpdate to download the latest definitions.
Given that the worm creates a system-level compromise, we are recommending a full system format for infected machines.
This is the only way to completely ensure network and data security after a compromise such as this. |
| 12/15/04 |
W32.Erkez.D
More info:
Symantec
F-Secure
Network Associates
Trend Micro
Sophos
top of page
|
Win9x/NT/ME/2000/XP:
W32.Erkez.D is a mass mailing worm that has spread worldwide.
The worm arrives via an email message appearing to be a Christmas greeting.
Once the included attachment is executed, the worm will lower security settings, terminate processes, and open a back door on the compromised computer.
See the W32.Erkez.D page for more detailed information. |
Symantec Anti-Virus users: Upgrade your definition file to 12/14/2004 revision 9 (i) or later. Be sure to update your definitions as soon as possible. You can use LiveUpdate to download the latest definitions.
Given that the worm creates a system-level compromise, we are recommending a full system format for infected machines.
This is the only way to completely ensure network and data security after a compromise such as this. |
| 11/09/04 |
W32.Mydoom.AH (& .AI)
More info:
Symantec
F-Secure
Network Associates
Trend Micro
Symantec (.AI)
top of page
|
Win9x/NT/ME/2000/XP:
W32.Mydoom.AH and .AI are two mass mailing worms that have spread worldwide.
These worms utilize a combination of social engineering and an unpatched exploit in Internet Explorer to infect machines. They also open up a backdoor on TCP port 1639.
The worm arrives via an email message with an HTML-formatted message body that will contain language that
will either ask the user to view photos, or to confirm a PayPal
transaction.
See the W32.Mydoom.AH page for more detailed information. |
Symantec Anti-Virus users: Upgrade your definition file to 11/09/2004 revision 9 (i) or later. Be sure to update your definitions as soon as possible. You can use LiveUpdate to download the latest definitions.
Given that the worm creates a system-level compromise, we are recommending a full system format for infected machines.
This is the only way to completely ensure network and data security after a compromise such as this. |
| 10/29/04 |
W32.Beagle.AW
More info:
Symantec
top of page
|
Win9x/NT/ME/2000/XP:
W32.Beagle.AW is a mass mailing worm that has spread quickly.
The worm arrives via an email message with an attachment, which, if executed, will email itself to all entries found on the machine.
The worm sends itself as an email with a subject of either
• Re:
• Re: Hello
• Re: Hi
• Re: Thank you!
• Re: Thanks :)
The emails will also contain an attachment of either
• Price
• price
• Joke
The worm also opens a backdoor on TCP port 81. This could allow remote attackers to access infected machines.
The W32.Beagle.AW page will contain more detailed information. |
Symantec Anti-Virus users: Upgrade your definition file to 10/29/2004 revision x (24) or later. Be sure to update your definitions as soon as possible. Be sure to update your definitions as soon as possible. You can use LiveUpdate to download the latest definitions.
Given that the worm creates a system-level compromise, we are recommending a full system format for infected machines.
This is the only way to completely ensure network and data security after a compromise such as this. |
| 5/3/04 |
W32.Sasser.B.Worm
More info:
Symantec
F-Secure
Network Associates
Trend
Micro
Sophos
top
of page
|
Win2000/XP:
W32.Sasser.B.Worm is a worm (very
similar to Sasser.Worm) that spreads by scanning randomly-chosen IP addresses
for machines vulnerable to the LSASS exploit. This worm and a couple of
it's variants have quickly spread worldwide (beginning early May 1st).
W32.Sasser.Worm starts an FTP server on TCP port 5554 and generates traffic
on TCP ports 445 and 9996. It also starts 128 network scanning processes
most likely causing severe degradation in system performance.
|
Symantec Anti-Virus users: Upgrade
your definition file to 05/02/2004 revision 38 (al) or later. Be
sure to update your definitions as soon as possible.
Make sure you apply the appropriate MS04-11 patch
to protect against attacks seeking to exploit this vulnerability.
To prevent machines from being infected or targeted, you must install the
patch for the LSASS vulnerability. The patch can be downloaded from the
following sites:
Windows
2000
Windows
XP
Given that the worm creates a system-level compromise, we are recommending a full system format for infected machines.
This is the only way to completely ensure network and data security after a compromise such as this. |
| 5/3/04 |
W32.Sasser.Worm
More info:
Symantec
F-Secure
Network Associates
Trend
Micro
Sophos
top
of page
|
Win2000/XP:
W32.Sasser.Worm is a worm that spreads by scanning
randomly-chosen IP addresses for machines vulnerable to the LSASS exploit.
This worm and a couple of it's variants have quickly spread worldwide
(beginning early May 1st).
W32.Sasser.Worm starts an FTP server on
TCP port 5554 and generates traffic on TCP ports 445 and 9996. It also
starts 128 network scanning threads most likely causing severe degradation
in system performance.
|
Symantec Anti-Virus users: Upgrade
your definition file to 05/02/2004 revision 38 (al) or later. Be
sure to update your definitions as soon as possible.
Make sure you apply the appropriate MS04-11 patch to protect against attacks
seeking to exploit this vulnerability.
To prevent machines from being infected or targeted, you must install the
patch for the LSASS vulnerability. The patch can be downloaded from the
following sites:
Windows
2000
Windows
XP
Given that the worm creates a system-level compromise, we are recommending a full system format for infected machines.
This is the only way to completely ensure network and data security after a compromise such as this. |
| 4/28/04 |
LSASS vulnerability
More info:
Microsoft
top
of page
|
WinNT/2000/XP:
Recently machines not patched with the MS04-11 patch have been attacked.
Machines without the patch that have been attacked are popping up a message
window saying that the LSASS service has been shut down, and the machine
will reboot in 60 seconds. The machine will then constantly reboot unless
it's disconnected from the network.
There is an marked increase in the amount of network traffic
seen on the following ports:
TCP 135, 139, 445, 1025, 1433, 2745
We currently do not have reports of any backdoor programs being
installed when a machine exhibits the above behavior. |
Symantec Anti-Virus users: Upgrade
your definition file to the latest definitions.
Be sure
to update your definitions often and as soon as possible because it's
likely automated worms will soon be written to exploit this vulnerability.
Make sure you apply the appropriate MS04-11 patch
to protect against attacks seeking to exploit this vulnerability.
To prevent machines from being infected or targeted, you must install the
patch for the LSASS vulnerability. The patch can be downloaded from the following
sites:
Windows 2000
Windows XP
If a machine gets compromised on a system level by a worm that exploits LSASS, such as Sasser, we'd are recommend a full system format.
Formatting is the only way to completely ensure network and data security after a compromise such as this. |
| 4/28/04 |
W32.Netsky.AB
More info:
Symantec
F-Secure
Network Associates
Trend
Micro
Sophos
top
of page
|
Win9x/NT/ME/2000/XP:
W32.Netsky.AB is a mass mailing worm that
has spread worldwide rather quickly.
The worm arrives via an email message with a randomly named attachment,
which, if executed, will email itself to all entries found on the machine.
Emails generated by the worm will forge the "From:" address,
and have random subjects, message bodies, and randomly named attachments. |
Symantec Anti-Virus users: Upgrade
your definition file to 04/28/2004 revision 9 (i) or later. Be
sure to update your definitions as soon as possible.
This variant of Netsky doesn't open any backdoors (so a removal tool should
suffice), but Symantec hasn't created a removal tool for this variant yet.
Until they do, follow their manual removal instructions. |
| 4/28/04 |
W32.Beagle.X
More info:
Symantec
F-Secure
Network Associates
Trend
Micro
Sophos
top
of page
|
Win9x/NT/ME/2000/XP:
W32.Beagle.X is a mass mailing worm that
has spread quickly.
The worm arrives via an email message with an attachment, which, if executed,
will email itself to all entries found on the machine.
The worm sends itself as an email with a random subject, body, and attachment.
The worm also opens a backdoor.
This could allow remote attackers to access infected machines.
See the W32.Beagle.X page
for more detailed information. |
Symantec Anti-Virus users: Upgrade
your definition file to 04/28/2004 revision al (38) or later. Be
sure to update your definitions as soon as possible. You can use LiveUpdate
to download the latest definitions.
Given that the worm creates a system-level compromise, we are recommending
a full system format for infected machines.
This is the only way to completely ensure network and data security after
a compromise such as this. |
| 4/27/04 |
W32.Beagle.W
More info:
Symantec
F-Secure
Network Associates
Trend
Micro
Sophos
top
of page
|
Win9x/NT/ME/2000/XP:
W32.Beagle.W is a mass mailing worm that
has spread quickly.
The worm arrives via an email message with an attachment, which, if
executed, will email itself to all entries found on the machine.
The worm sends itself as an email with a random subject, body, and attachment.
The worm also opens a backdoor.
This could allow remote attackers to access infected machines.
See the W32.Beagle.W page
for more detailed information. |
Symantec Anti-Virus users: Upgrade
your definition file to 04/26/2004 revision az (52) or later. Be
sure to update your definitions as soon as possible. You can use LiveUpdate
to download the latest definitions.
Given that the worm creates a system-level compromise, we are recommending
a full system format for infected machines.
This is the only way to completely ensure network and data security after
a compromise such as this. |
| 4/20/04 |
W32.Netsky.Y
More info:
Symantec
F-Secure
Network Associates
Trend
Micro
Sophos
top
of page
|
Win9x/NT/ME/2000/XP:
W32.Netsky.Y is a mass mailing worm (very
similar to Nesky.X) that has spread worldwide rather quickly.
The worm arrives via an email message with a randomly named attachment,
which, if executed, will email itself to all entries found on the machine.
Emails generated by the worm will forge the "From:" address,
and have random subjects, message bodies, and randomly named attachments.
The worm also opens a backdoor on
TCP port 82. This could allow remote attackers to access infected machines. |
Symantec Anti-Virus users: Upgrade
your definition file to 04/21/2004 revision 35 (ai) or later. Be
sure to update your definitions as soon as possible.
Given that the worm creates a system-level compromise, we are recommending
a full system format for infected machines.
This is the only way to completely ensure network and data security after
a compromise such as this. |
| 4/20/04 |
W32.Netsky.X
More info:
Symantec
F-Secure
Network Associates
Trend
Micro
Sophos
top
of page
|
Win9x/NT/ME/2000/XP:
W32.Netsky.X is a mass mailing worm that
has spread worldwide rather quickly.
The worm arrives via an email message with a randomly named attachment,
which, if executed, will email itself to all entries found on the machine.
Emails generated by the worm will forge the "From:" address,
and have random subjects, message bodies, and randomly named attachments.
The worm also opens a backdoor on
TCP port 82. This could allow remote attackers to access infected machines. |
Symantec Anti-Virus users: Upgrade
your definition file to 04/21/2004 revision 17 (q) or later. Be
sure to update your definitions as soon as possible.
Given that the worm creates a system-level compromise, we are recommending
a full system format for infected machines.
This is the only way to completely ensure network and data security after a compromise
such as this. |
| 4/15/04 |
W32.Gaobot.ZX
More info:
Symantec
top
of page
|
Win9x/NT/ME/2000/XP:
W32.Gaobot.ZX is a worm/backdoor that
has spread rather quickly and has hit parts of campus.
The worm spreads by exploiting various Windows vulnerabilities and through
network shares with weak passwords. |
Symantec Anti-Virus users: Upgrade
your definition file to 04/13/2004 or later. Be sure to update your
definitions as soon as possible. You can use LiveUpdate to download the
latest definitions.
Given that the worm creates a system-level compromise, we are recommending
a full system format for infected machines.
This is the only way to completely ensure network and data security after a compromise
such as this. |
| 4/05/04 |
W32.Sober.F
More info:
Symantec
F-Secure
Network Associates
Trend Micro
Sophos
top of page
|
Win9x/NT/ME/2000/XP:
W32.Sober.F is a mass mailing worm that has spread worldwide rather quickly.
The worm arrives via an email message with a randomly named attachment, which, if executed, will email itself to all entries found on the machine.
Emails generated by the worm will forge the "From:" address, and have random subjects, message bodies, and randomly named attachments.
|
Norton Anti-Virus users: Upgrade your definition file to 04/04/2004 or later. Be sure to update your definitions as soon as possible. You can use LiveUpdate to download the latest definitions.
Symantec has released a removal tool for W32.Sober.F which is sufficient to repair a system infected by this worm. If you have any trouble downloading or running the tool, follow Symantec's manual removal instructions. |
| 3/29/04 |
W32.Netsky.Q
More info:
Symantec
F-Secure
Network Associates
Trend Micro
Sophos
top of page
|
Win9x/NT/ME/2000/XP:
W32.Netsky.Q is a mass mailing worm that has spread worldwide rather quickly.
The worm arrives via an email message with a randomly named attachment, which, if executed, will email itself to all entries found on the machine.
Emails generated by the worm will forge the "From:" address, and have random subjects, message bodies, and randomly named attachments.
The worm also uses the 3-yr old "Incorrect MIME Header Can Cause IE to Execute E-mail Attachment" vulnerability to cause unpatched systems to auto-execute the worm when reading or previewing an infected message. |
Norton Anti-Virus users: Upgrade your definition file to 03/28/2004 revision 50 (ax) or later. Be sure to update your definitions as soon as possible. You can use LiveUpdate to download the
latest definitions.
Symantec has released a removal tool for W32.Netsky.Q which is sufficient to repair a system infected by this worm. If you have any trouble downloading or running the tool, follow Symantec's manual removal instructions. |
| 3/26/04 |
W32.Beagle.U
More info:
Symantec
F-Secure
Network Associates
Trend Micro
Sophos
top of page
|
Win9x/NT/ME/2000/XP:
W32.Beagle.U is a mass mailing worm that has spread quickly.
The worm arrives via an email message with an .exe attachment, which, if executed, will email itself to all entries found on the machine.
The worm sends itself as an email with a blank subject and body and a randomly named attachment.
The worm also opens a backdoor on TCP port 4751. This could allow remote attackers to access infected machines.
See the W32.Beagle.U page for more detailed information. |
Norton Anti-Virus users: Upgrade your definition file to 03/26/2004 revision g (7) or later. Be sure to update your definitions as soon as possible. You can use LiveUpdate to download the latest definitions.
Given that the worm creates a system-level compromise, we are recommending a full system format for infected machines.
This is the only way to completely ensure network and data security after a compromise such as this. |
| 3/22/04 |
W32.Netsky.P
More info:
Symantec
F-Secure
Network Associates
Trend Micro
Sophos
top of page
|
Win9x/NT/ME/2000/XP:
W32.Netsky.P is a mass mailing worm that has spread rather quickly.
The worm arrives via an email message with a randomly named attachment, which, if executed, will email itself to all entries found on the machine.
Emails generated by the worm will forge the "From:" address, and have random subjects, message bodies, and randomly named attachments that end in .pif. |
Norton Anti-Virus users: Upgrade your definition file to 03/22/2004 revisions 7 (g) or later. Be sure to update your definitions as soon as possible. You can use LiveUpdate to download the latest definitions.
Symantec has released a removal tool for W32.Netsky.P which is sufficient to repair a system infected by this worm. If you have any trouble downloading or running the tool, follow Symantec's manual removal instructions. |
| 3/22/04 |
W32.Witty.Worm
More info:
Symantec
F-Secure
Network Associates
Trend Micro
top of page
|
Win9x/NT/ME/2000/XP:
W32.Witty.Worm is a memory-resident automated worm that spreads through networks and specifically attacks only machines running vulnerable versions of BlackIce firewall software. It has attacked a couple of campus machines running BlackIce.
See the W32.Witty.Worm page for more detailed information. |
Norton Anti-Virus users: Since this worm is memory-resident and doesn't create any files on the hard drive, virus definitions won't detect it.
If possible (the worm overwrites random sectors of the hard drive), follow Symantec's manual removal instructions. |
| 3/13/04 |
W32.Beagle.M
More info:
Symantec
F-Secure
Network Associates
Trend Micro
Sophos
top of page
|
Win9x/NT/ME/2000/XP:
W32.Beagle.M is a mass mailing worm that has spread quickly.
The worm arrives via an email message with a .pif, .rar, or .zip attachment, which, if executed, will email itself to all entries found on the machine.
Emails generated by the worm will forge the "From:" address, and will have subjects and message bodies that make the email appear like a legitimate message from the recipient's mail server administrator.
The worm also opens a backdoor on TCP port 2556. This could allow remote attackers to access infected machines.
See the W32.Beagle.M page for more detailed information. |
Norton Anti-Virus users: Upgrade your definition file to 03/13/2004 or later. Be sure to update your definitions as soon as possible. You can use LiveUpdate to download the latest definitions.
Given that the worm creates a system-level compromise, we are recommending a full system format for infected machines.
This is the only way to completely ensure network and data security after a compromise such as this. |
| 3/09/04 |
W32.Netsky.K
More info:
Symantec
F-Secure
Network Associates
Trend Micro
Sophos
top of page
|
Win9x/NT/ME/2000/XP:
W32.Netsky.K is a mass mailing worm that has spread rather quickly.
The worm arrives via an email message with a randomly named attachment, which, if executed, will email itself to all entries found on the machine.
Emails generated by the worm will forge the "From:" address, and have random subjects, message bodies, and randomly named attachments that end in .pif.
See the W32.Netsky.K page for more detailed information. |
Norton Anti-Virus users: Upgrade your definition file to 03/08/2004 revisions 18 (r) or later. Be sure to update your definitions as soon as possible. You can use LiveUpdate to download the latest definitions.
Symantec has released a removal tool for W32.Netsky.K which is sufficient to repair a system infected by this worm. If you have any trouble downloading or running the tool, follow Symantec's manual removal instructions. |
| 3/08/04 |
W32.Sober.D
More info:
Symantec
F-Secure
Network Associates
Trend Micro
Sophos
top of page
|
Win9x/NT/ME/2000/XP:
W32.Sober.D is a mass mailing worm that is spreading around the world.
The worm arrives via an email message with a .exe or .zip attachment, which, if executed, will email itself to all entries found on the machine.
Emails generated by the worm purport to be from Microsoft, and will have subjects and message bodies that urge the user to open the attachment to patch against the MyDoom virus.
See the W32.Sober.D page for more detailed information. |
Norton Anti-Virus users: Upgrade your definition file to 03/08/2004, revision 7 (g) or later. Be sure to update your definitions as soon as possible. You can use LiveUpdate to download the latest definitions.
To remove this worm, follow Symantec's removal instructions. |
| 3/03/04 |
W32.Beagle.K
More info:
Symantec
F-Secure
Network Associates
Trend Micro
Sophos
top of page
|
Win9x/NT/ME/2000/XP:
W32.Beagle.K is a mass mailing worm that has spread quickly.
The worm arrives via an email message with a .pif. or .zip attachment, which, if executed, will email itself to all entries found on the machine.
Emails generated by the worm will forge the "From:" address, and will have subjects and message bodies that make the email appear like a legitimate message from the recipient's mail server administrator.
The worm also opens a backdoor on TCP port 2745. This could allow remote attackers to access infected machines.
See the W32.Beagle.K page for more detailed information. |
Norton Anti-Virus users: Upgrade your definition file to 03/03/2004 or later. Be sure to update your definitions as soon as possible. You can use LiveUpdate to download the latest definitions.
Given that the worm creates a system-level compromise, we are recommending a full system format for infected machines.
This is the only way to completely ensure network and data security after a compromise such as this. |
| 3/01/04 |
W32.Netsky.D
More info:
Symantec
F-Secure
Network Associates
Trend Micro
Sophos
top of page
|
Win9x/NT/ME/2000/XP:
W32.Netsky.D is a mass mailing worm that has spread rather quickly.
The worm arrives via an email message with a randomly named attachment, which, if executed, will email itself to all entries found on the machine.
Emails generated by the worm will forge the "From:" address, and have random subjects, message bodies, and attachments.
See the W32.Netsky.D page for more detailed information. |
Norton Anti-Virus users: Upgrade your definition file to 03/01/2004 or later. Be sure to update your definitions as soon as possible. You can use LiveUpdate to download the latest definitions.
Symantec has released a removal tool for W32.Netsky.D which is sufficient to repair a system infected by this worm. If you have any trouble downloading or running the tool, follow Symantec's manual removal instructions. |
| 3/01/04 |
W32.Beagle.E
More info:
Symantec
F-Secure
Network Associates
Trend Micro
Sophos
top of page
|
Win9x/NT/ME/2000/XP:
W32.Beagle.E is a mass mailing worm that has spread rather quickly.
The worm arrives via an email message with a randomly named attachment, which, if executed, will email itself to all entries found on the machine.
The worm also opens a backdoor on TCP port 2745. This could allow remote attackers to access infected machines.
See the W32.Beagle.E page for more detailed information. |
Norton Anti-Virus users: Upgrade your definition file to 02/28/2004 or later. Be sure to update your definitions as soon as possible. You can use LiveUpdate to download the latest definitions.
Given that the worm creates a system-level compromise, we are recommending a full system format for infected machines.
This is the only way to completely ensure network and data security after a compromise such as this. |
| 2/25/04 |
W32.Netsky.C
More info:
Symantec
F-Secure
Network Associates
Trend Micro
top of page
|
Win9x/NT/ME/2000/XP:
W32.Netsky.C is a mass mailing worm that has spread rather quickly.
The worm arrives via an email message with a randomly named attachment, which, if executed, will email itself to all entries found on the machine.
See the W32.Netsky.C page for more detailed information. |
Norton Anti-Virus users: Upgrade your definition file to 02/25/2004 or later. Be sure to update your definitions as soon as possible. You can use LiveUpdate to download the latest definitions.
Run Symantec's removal tool. If you cannot download or run it, you can follow Symantec's manual removal instructions. |
| 2/24/04 |
W32.Mydoom.F
More info:
Symantec
F-Secure
Network Associates
Trend
Micro
Sophos
top
of page
|
Win9x/NT/ME/2000/XP:
W32.Mydoom.F is a mass mailing worm that
has spread worldwide.
The worm opens a backdoor listening on port 1080, may display a
fake message, terminates several different
processes, attempts a DoS on microsoft.com and riaa.com on specific days
of the month, and randomly deletes files with the following extensions.
.mdb
.doc
.xls
.sav
.jpg
.avi
.bmp
The
worm arrives via an email message with a randomly named attachment,
which, if executed, will email itself to all entries found on the
machine.
See the W32.Mydoom.F page
for more detailed information. |
Symantec Anti-Virus users: Upgrade
your definition file to 02/23/2004 or later. Be sure to update your
definitions as soon as possible. You can use LiveUpdate to download the
latest definitions.
Given that the worm creates a system-level compromise, we are recommending
a full system format for infected machines.
This is the only way to completely ensure network and data security after a compromise
such as this. |
| 2/18/04 |
W32.Netsky.B
More info:
Symantec
F-Secure
Network Associates
Trend Micro
top of page
|
Win9x/NT/ME/2000/XP:
W32.Netsky.B is a mass mailing worm that has spread worldwide.
The worm arrives via an email message with a randomly named .exe attachment, which, if executed, will email itself to all entries found on the machine.
See the W32.Netsky.B page for more detailed information. |
Norton Anti-Virus users: Upgrade your definition file to 02/18/2004 or later. Be sure to update your definitions as soon as possible. You can use LiveUpdate to download the latest definitions.
Run Symantec's removal tool. If you cannot download or run it, you can follow Symantec's manual removal instructions. |
| 2/17/04 |
W32.Alua (Beagle.B)
More info:
Symantec
F-Secure
Network Associates
Trend Micro
top of page
|
Win9x/NT/ME/2000/XP:
W32.Alua, also known as W32.Beagle.B, is a mass mailing worm that is spread rapidly both on campus and worldwide.
The worm arrives via an email message with a randomly named .exe attachment, which, if executed, will email itself to all entries found on the machine. The worm also opens a backdoor on TCP port 8866. This could allow remote attackers to access infected machines.
See the W32.Alua / Beagle.B page for more detailed information. |
Norton Anti-Virus users: Upgrade your definition file to 02/17/2004 or later. Be sure to update your definitions as soon as possible. You can use LiveUpdate to download the latest definitions.
Given that the worm creates a system-level compromise, we are recommending a full system format for infected machines.
This is the only way to completely ensure network and data security after a compromise such as this. |
| 2/16/04 |
W32.Welchia.B
More info:
Symantec
F-Secure
Network Associates
Trend
Micro
top
of page
|
Windows 2000/XP:
W32.Welchia.B is a mass mailing worm that
has spread worldwide.
The worm spreads by utilizing the backdoor that
is opened on machines infected with the
W32.MyDoom (also known as W32.Novarg) worm. This
could allow remote attackers to access infected machines.
See the W32.Welchia.B page
for more detailed information. |
Symantec Anti-Virus users: Upgrade
your definition file to 02/11/2004 (revision 23) or later. Be sure
to update your definitions as soon as possible. You can use LiveUpdate
to download the latest definitions.
Given that the worm creates a system-level compromise, we are recommending
a full system format for infected machines.
This is the only way to completely ensure network and data security after
a compromise such as this. |
| 1/26/04 |
W32.Novarg.A (Mydoom.A)
More info:
Symantec
F-Secure
Network Associates
Trend Micro
top of page
|
Win9x/NT/ME/2000/XP:
W32.Novarg.A, also known as W32.Mydoom.A, is a mass mailing worm that has spread worldwide very rapidly.
The worm arrives via an email message with a randomly named attachment, which, if executed, will email itself to all entries found on the machine. The worm also creates a backdoor by opening a listening thread on a port in the range of 3127 to 3198. This could allow remote attackers to access infected machines.
See the W32.Novarg.A page for more detailed information. |
Norton Anti-Virus users: Upgrade your definition file to 01/26/2004 or later. Be sure to update your definitions as soon as possible. You can use LiveUpdate to download the latest definitions.
Given that the worm creates a system-level compromise, we are recommending a full system format for infected machines.
This is the only way to completely ensure network and data security after a compromise such as this. |
| 1/18/04 |
W32.Beagle.A
More info:
Symantec
F-Secure
Network Associates
Trend Micro
Sophos
top of page
|
Win9x/NT/ME/2000/XP:
W32.Beagle.A is a mass mailing worm that initially began spreading very rapidly but has since died down.
The worm arrives via an email message with a randomly named attachment, which, if executed, will email itself to all entries found on the machine. W32.Beagle.A also creates a backdoor by opening a listening thread on port 6777. This could allow remote attackers to access infected machines.
See the W32.Beagle.A page for more detailed information. |
Norton Anti-Virus users: Upgrade your definition file to 01/18/2004 or later. Be sure to update your definitions as soon as possible. You can use LiveUpdate to download the latest definitions.
Given that the worm creates a system-level compromise, we are recommending a full system format for infected machines.
This is the only way to completely ensure network and data security after a compromise such as this. |
| 12/18/03 |
Trojan.Sinkin
More info:
Symantec
Network Associates
Trend Micro
Sophos
top of page
|
Win9x/NT/ME/2000/XP:
Trojan.Sinkin is a trojan/worm that has begun spreading on campus.
Trojan.Sinkin attempts to spread by sending a hyperlink to contacts on a user's AOL Instant Messenger (AIM) Buddy List
When the link is visited with an unpatched version of IE, exploit code will download and install the trojan/worm.
See the Trojan.Sinkin page for more detailed information. |
Norton Anti-Virus users: Upgrade your definition file to 10/14/2003 or later. Be sure to update your definitions as soon as possible. You can use LiveUpdate to download the latest definitions.
To remove the virus, follow Symantec's removal instructions. |
| 10/31/03 |
W32.Mimail.C
More info:
Symantec
F-Secure
Network Associates
Trend Micro
Sophos
top of page
|
Win9x/NT/ME/2000/XP:
W32.Mimail.C is a worm that has spread worldwide and has appeared on campus.
The worm attempts to spread through email via an attachment named photos.zip and the subject "Re[2]: our private photos [random string of letters]"
When the attachment is executed, the worm will copy itself to the hard drive, create a registry entry, and mail itself to addresses it finds in files with various extensions.
See the W32.Mimail.C page for more detailed information. |
Norton Anti-Virus users: Upgrade your definition file to 10/31/2003 or later. Be sure to update your definitions as soon as possible. You can use LiveUpdate to download the latest definitions.
To remove the virus, run Symantec's removal tool.
If the tool fails, follow Symantec's manual removal instructions. |
| 10/02/03 |
Trojan.Qhosts
More info:
Symantec
F-Secure
Network Associates
Trend Micro
Sophos
top of page
|
Win9x/NT/ME/2000/XP:
Trojan.Qhosts is a trojan that has spread worldwide and has appeared on campus.
The trojan spreads to a machine when a user browses to a website that contains viral HTML code written to exploit a vulnerability in Internet Explorer. For more information and a patch for this vulnerability, see Microsoft's write-up.
When an infected HTML page is opened, the trojan will change DNS settings, modify several registry keys and make modifications to the local "Hosts" file.
For a complete listing of the worm's activities, see the Characteristics section on the full Trojan.Qhosts write-up.
See the Trojan.Qhosts page for more detailed information. |
Norton Anti-Virus users: Upgrade your definition file to 10/02/2003 or later. Be sure to update your definitions as soon as possible. You can use LiveUpdate to download the latest definitions.
NOTE: There is now a patch for the vulnerability this trojan exploits. Please make sure you install it.
To remove the virus, run Symantec's removal tool.
If the tool fails, follow Symantec's manual removal instructions. |
| 9/19/03 |
W32.Swen.A@mm
More info:
Symantec
F-Secure
Network Associates
Trend Micro
Sophos
top of page
|
Win9x/NT/ME/2000/XP:
W32.Swen.A@mm is a mass mailing worm that has spread worldwide and has appeared on campus.
The worm attempts to spread via email with a randomly named attachment or via KaZaA, IRC, Network Shares, or newsgroups.
If executed, the worm will email itself to addresses it finds on the local machine, terminate a large number of anti-virus and security programs, modify and add several registry keys and drop itself and a couple of other files onto the hard drive. For a complete listing of the worm's activities, see the Characteristics section on the full W32.Swen.A write-up.
Please Note: The worm spoofs the From: address on the messages it sends to make the messages appear to be coming from Microsoft or to look like bounce-back messages. Be sure to examine a message's full headers to determine where it originated. NOTE: The Return-Path field is not forged. You may use this value from the full headers in helping track down infected machines.
See the W32.Swen.A@mm page for more detailed information. |
Norton Anti-Virus users: Upgrade your definition file to 09/19/2003 or later. Be sure to update your definitions as soon as possible. You can use LiveUpdate to download the latest definitions.
To remove the virus, try running Symantec's removal tool.
If the tool fails to run, follow step 4 (a-f) of Symantec's removal instructions, and then try running the tool. If the tool still fails to run, you'll need to follow Symantec's manual removal instructions linked just above. |
| 8/20/03 |
W32.Squirm@mm
More info:
Symantec
top of page
|
Win9x/NT/ME/2000/XP:
W32.Squirm@mm is a mass mailing worm that has appeared on parts of campus in large volumes today (Aug 20).
The worm attempts to spread via email with an attachment named either patch.zip or patch_329390.exe. If executed, the worm will open and listen on port 61282 as well as send itself to all the email addresses it finds in the user's Outlook address book. The worm also tries to spread through file sharing applications and by using DCC, the worm propogates through IRC.
Please Note: The worm spoofs the From: and Return-Path: addresses on the messages it sends to make the messages look like they are coming from support@microsoft.com. Be sure to examine a message's full headers to determine where it originated.
See the W32.Squirm@mm page for more detailed information. |
Norton Anti-Virus users: Upgrade your definition file to 08/20/2003 or later. Be sure to update your definitions as soon as possible. You can use LiveUpdate to download the latest definitions.
Given that the worm creates a system-level compromise by opening a port, we recommend a full system format for infected machines.
This is the only way to completely ensure network and data security after a compromise such as this. |
| 8/20/03 |
W32.Welchia.Worm
More info:
Symantec
F-Secure
Network Associates
Trend
Micro
Sophos
top
of page
|
Windows 2000 and XP:
W32.Welchia.Worm is a worm that has spread worldwide.
The worm attempts to spread by exploiting two different Windows vulnerabilities
(DCOM RPC and WebDav - more information on the full write-up page).
See the W32.Welchia.Worm
page for more detailed information. |
Symantec Anti-Virus users: Upgrade
your definition file to 08/18/2003 or later. Be sure to update your
definitions as soon as possible. You can use LiveUpdate to download the
latest definitions.
Given that the worm creates a system-level compromise, we are recommending
a full system format for infected machines.
This is the only way to completely ensure network and data security after
a compromise such as this. |
| 8/19/03 |
W32.Sobig.F@mm
More info:
Symantec
F-Secure
Network Associates
Trend
Micro
Sophos
top
of page
|
Win9x/NT/ME/2000/XP:
W32.Sobig.F is a mass mailing worm that has spread worldwide.
The worm attempts to spread via email (with an attachment ending in either
.pif or .scr) and via write accessible network shares. If executed, the
worm sends itself to all the email addresses it finds in files with the
following extensions .wab, .dbx, .htm, .html, .hlp, .mht, .eml, and .txt.
Please Note: The worm spoofs the From: and Return-Path:
addresses on the messages it sends. Be sure to examine a message's full
headers to determine where it originated.
See the W32.Sobig.F
page for more detailed information. |
Symantec Anti-Virus users: Upgrade
your definition file to 08/19/2003 or later. Be sure to update your
definitions as soon as possible. You can use LiveUpdate to download the
latest definitions.
To remove the virus see Symantec's W32.Sobig.F
Removal Tool page where you can download their removal tool and read
about it as well.
If for any reason you cannot obtain or run the tool linked above, you
must remove the worm manually. |
| 8/12/03 |
W32.Blaster.Worm
More info:
Symantec
F-Secure
Network Associates
Trend
Micro
Sophos
SANS
top
of page
|
WinNT/2000/XP/Server 2003:
W32.Blaster.Worm is a worm that has been spreading rapidly and exploits the DCOM RPC vulnerability.
There have been several reports of this worm appearing on campus and it
is spreading on a wide scale in the wild.
See the W32.Blaster.Worm page for more detailed information. |
Symantec Anti-Virus users: Upgrade
your definition file to 08/11/2003 version number 50811s, also known
as August 11, 2003 rev 19, or greater. Be sure to update your definitions
as soon as possible. You can use LiveUpdate to download the latest definitions.
Given that the worm gives full administrator acces to compromised systems,
we are recommending a full system format for infected
machines.
This is the only way to completely ensure network and data security after
a compromise such as this. |
| 8/01/03 |
W32.Mimail.A@mm
More info:
Symantec
F-Secure
Network Associates
Trend Micro
Sophos
top of page
|
Win9x/NT/ME/2000/XP:
W32.Mimail.A is a mass mailing worm that arrives via an email attachment named Message.zip. When the message is viewed, it will attempt to exploit a Windows vulnerability (patch found here) to create a copy of the worm named Foo.exe in the Temporary Internet Files folder (this behavior will also be seen if a user clicks the attachment). Then it |
