Two heads-up are better than one- Sober.ac and Optix alerts

Started by Nancy McAleavey, October 06, 2005, 03:43:15 PM

Previous topic - Next topic

0 Members and 1 Guest are viewing this topic.

Nancy McAleavey

Two heads-up are better than one

We've received and analyzed the latest Sober.ac worm, it's beginning to propagate widely. It appears as a ZIP attachment , typically pword_change.zip or photoattch.zip. Upon opening it creates its folder, searches the HD for addresses and propagates in outbound email (similar to Netsky), creating a large amount of disk activity in the process. Others will likely follow BOClean with their detections. (We've seen 5 variants of this new Sober so far today. BOClean detects all.)

A private build of Optix has been reported propagating through corporate network sites and AOL IM (exploiting the MSJET hole as well as port 445 and other usual exploits) as CRRSCR.EXE and CRRSCR32.EXE. There are a large number of Optix repacks circulating in the wild as well, BOClean is detecting these as Optix.1.3.3, others may detect as other variants.

Corrine



Take a walk through the "Security Garden" -- Where Everything is Coming up Roses!

Remember - A day without laughter is a day wasted.
May the wind sing to you and the sun rise in your heart.