Virus Alerts
Virus and Operating System Updates
Virus Information
Anti-virus companies are reporting a worm that spreads via a new vulnerability in Internet Explorer. The vulnerability is not present in Windows XP Service Pack 2, but in all earlier versions of Internet Explorer 6, and no patch is available. It involves a buffer overflow triggered by an IFRAME or EMBED tag, which has an oversized SRC or NAME attribute. The worm, known as MyDoom.ag in McAfee's naming, does not have a file attachment, as is typical of mail worms. Instead, it installs a Web server on Port 1639 of the infected system. The e-mails it sends out to spread itself contains a link to the server on the infected computer. The page served when a user clicks the link, which takes the form http://aaa.bbb.ccc.ddd:1639/webcam.htm (where aaa.bbb.ccc.ddd is the IP address of the infected user), invokes the Internet Explorer vulnerability. The worm then takes over, downloading more files and spreading itself. The use of an IP address means that users behind an NAT server cannot effectively spread the worm. Indeed, Ken Dunham, director of malicious code at iDefense Inc., said, "Home and SOHO users without sufficient perimeter defenses are most likely to be victimized." Most other anti-virus vendors are also terming the new worm a MyDoom variant, although Sophos plc. calls it Bofra-A. Vendors are generally terming this a low threat because it hasn't been seen in the wild, but some have elevated the threat because of the new techniques and the absence of a patch for the vulnerability.
What is it? W32/Bagle.az@MM is a Medium Risk mass-mailing worm that installs a Remote Access component that can provide hackers access to your computer. Carried inside an email attachment, the virus spreads by emailing itself to e-mail addresses found on your computer and copies itself to folders used by popular file-sharing programs such as KaZaa, Bearshare and Limewire. Like its predecessors, it also tries to terminate anti-virus and other security software protection. What should I look for?
How do I know if I've been infected? Communication Port 81 (TCP) open. Outgoing messages with noted body content and attachments. What can I do to prevent or fix an infection? Make sure your virus software's virus definitions are up to date, and that you do not open and immediately delete any e-mail message matching the description above.
The "Sasser" worm can infect a computer even if no one is using it. Infected computers might display error messages and try to repeatedly reboot themselves. Here are instructions to follow if you suspect that your computer contains the worm:
Here are other tools that can detect and remove Sasser:
One of the best preventative measures you can do to avoid viruses is to patch vulnerabilities in your Windows operating system with Windows Update. The following instructions will let you know how to perform these updates manually or to set your computer to download them automatically. How to Perform Windows Update (manually) Windows Update will update applications provided by Microsoft (O/S, Internet Explorer, Office, etc.).
Enable Automatic Updates The Automatic Updates feature in Windows notifies you when critical updates are available for your computer. · For Windows XP
· For Windows 2000 (Requires Service Pack 3 )
If you are not sure about Windows update, or for answers to specific questions, call Customer Care at 888-364-9000 or e-mail us at support@setel.com.
A computer virus, disguised as an official-looking e-mail from SouthEast Telephone or other ISPs, is now circulating throughout the World Wide Web, in an attempt to wreak havoc on computer systems. The hoax e-mail's subject line reads, "Warning about your e-mail account" or "Notify about your e-mail account utilization" or something similar. It is extremely important not to open this infected e-mail's ZIP file, which contains the virus. The e-mail the several varients of the worm generates takes the following general form, spoofing the receiver's address to make the virus seem to come from the network administrator, support, or management, and contains a message similar to:
The creator(s) of newer variants of the Bagle virus improved on the attached infected ZIP file by protecting the attachment with a password, preventing some antivirus scanners from examining it. The newer variants open a backdoor on TCP port 2745 and uses its own SMTP engine to spread through email. It then sends the attacker the port on which the backdoor listens, as well as the IP address. Finally, it attempts to spread through file-sharing networks, such as Kazaa and iMesh, by dropping itself into the folders that contain "shar" in their names. SouthEast Telephone continues to provide virus protection on its e-mail server and keeps virus definitions as updated as possible. New viruses appear on a daily basis and we are working hard to identify and neutralize those as quickly as possible. However, we strongly recommend that you install anti-virus software on your computer and keep the virus definitions updated. For more information and virus removal tools, visit the Symantec Website. We would like to remind all e-mail users that under no circumstance would we send any e-mail from a company address such as Support or Admin requesting that you open a file attachment.
|
All rights reserved.
