Wurmnews 09.03.04 [Sober.d]

[ThaWild 10]

W32/Sober.d@MM is a Medium Risk mass-mailing worm posing as an official Microsoft patch for the Mydoom virus. Watch for telltale subject lines in English or German with the text "Microsoft Alarm: Please Read!" or "Microsoft Alarm: Bitte Lessen!" Note: Microsoft does not email patches.

The worm arrives as an executable attachment or inside a Zip archive. When run, it displays fake Windows warnings and error alerts. Using its own SMTP engine, W32/Sober.d@MM also mails itself to email addresses found on the infected computer.

Up-to-date McAfee VirusScan users with dat 4334 are protected from this threat.

Learn More about W32/Sober.d@MM

Scan for W32/Sober.d@MM

Caution: An infected email can come from addresses you recognize.

What to look for:

 

FROM: (sender) @microsoft. (country) where sender is taken from the following list:

Info, Center, UpDate, News, Help, Studio, Alert, Security

 

And country is taken from the following list:

 

* de (for messages in German)

* at (for messages in German)

* com (for messages in English)

 

SUBJECT: Varies, and contains random characters. For German and English messages respectively, the subject line starts:

 

* Microsoft Alarm: Bitte Lessen!

* Microsoft Alert: Please Read!

 

BODY:

(German version)

Neue Virus-Variante W32.Mydoom verbreitet sich schnell. Eine neue Mydoom-Variante verbreitet sich derzeit rasend schnell im Internet.

Wie seine Vorg

Zudem installiert er auf infizierten Systemen einen gefahrlichen Trojaner! Fuhrende Virenspezialisten melden bereis ein vermehrtes Aufkommen des W32.Mydoom alias W32.Novarg.

Bitte daten Sie Ihr System mit dem Patch ab, um sich vor diesem Sch

+++

+++ Microsoft Deutschland GmbH, Konrad-Zuse-Strasse 1

+++ 85716 Unterschleissheim, HRB 70438, DE 129 415 943

 

(English version)

New MyDoom Virus Variant Detected!

A new variant of the W32.Mydoom (W32.Novarg) worm spread rapidly through the Internet.

Anti-virus vendor Central Command claims that 1 in 45 e-mails contains the MyDoom virus. The worm also has a backdoor Trojan capability. By default, the Trojan component listens on port 13468.

 

Protection:

Please download this digitally signed attachment. This Update includes the functionality of previously released patches.

+++

+++ One Microsoft Way, Redmond, Washington 98052

+++ Restricted Rights at 48 CFR 52.227-19 com

 

 

ATTACHMENT: Either a .EXE or .ZIP, with varying filename.

 

quelle: http://www.mcafee.com

[scorpion0815 10]

THX für den Hinweis ThaWild

[ThaWild 10]

Man tut was man kann :D

[Rimeda 10]

Langsam nerven die Viren / Würmer etc. in diesem Jahr.

 

Ich hab das Gefühl das dieses Jahr wesentlich mehr und wesentlich nervigere Viecher im Netz kreisen wie in den letzten Jahren... und dabei haben die Saisonzeiten für Viren (Sommer / Herbst, wenn die meisten Urlaub haben) noch nicht angefangen....