[ExchangeList] Re: New worm seen in Europe

  • From: "Maglinger, Paul" <PMAGLINGER@xxxxxxxx>
  • To: <exchangelist@xxxxxxxxxxxxx>
  • Date: Thu, 24 Aug 2006 14:29:21 -0500

http://www.msexchange.org
-------------------------------------------------------A little more info...

Payload on this is still unknown.  It is network aware and spreads to
shares.  Sys Admin who found it is still trying to disect it to find out
more.  This is what the old one was doing:

http://www.symantec.com/security_response/writeup.jsp?docid=2006-071212-
0124-99&tabid=1

However, this version is different in that it is not being detected by
Symantec, but it has been turned in to them.  More as I get it...

-----Original Message-----
From: exchangelist-bounce@xxxxxxxxxxxxx
[mailto:exchangelist-bounce@xxxxxxxxxxxxx] On Behalf Of
ChongJa@xxxxxxxxxxxxxxxx
Sent: Thursday, August 24, 2006 13:07
To: exchangelist@xxxxxxxxxxxxx
Subject: [ExchangeList] Re: New worm seen in Europe

http://www.msexchange.org
-------------------------------------------------------Thanks. Yes
please post if you find any additional info.

-----Original Message-----
From: exchangelist-bounce@xxxxxxxxxxxxx
[mailto:exchangelist-bounce@xxxxxxxxxxxxx] On Behalf Of Maglinger, Paul
Sent: Thursday, August 24, 2006 12:51 PM
To: Exchangelist (Freelist)
Subject: [ExchangeList] New worm seen in Europe

http://www.msexchange.org
-------------------------------------------------------Looks like there
may be a new variant on the w32.looked worm making it's
presence known in Europe.  Looks like the w32.looked, except it appears
to be a zero day version.  I don't believe it has made it over here yet.
Just heard from a large global corporation that has branches over there
that a couple of their servers and a few workstations had it.
 
I'll let you know if I hear any more...
________________________________

Paul Maglinger, A+, CA, CCA, CET, MCSE 

Systems Administrator 
Shoe Carnival Inc. 
(812)867-4674 
pmaglinger@xxxxxxxx 


________________________________


 

-------------------------------------------------------
List Archives: http://www.freelists.org/archives/exchangelist/  
MSExchange Newsletter: http://www.msexchange.org/pages/newsletter.asp 
MSExchange Articles and Tutorials:
http://www.msexchange.org/articles_tutorials/ 
MSExchange Blogs: http://blogs.msexchange.org/ 
-------------------------------------------------------
Visit TechGenix.com for more information about our other sites:
http://www.techgenix.com 
-------------------------------------------------------
To unsubscribe visit http://www.msexchange.org/pages/exchangelist.asp
Report abuse to listadmin@xxxxxxxxxxxxxx 

-------------------------------------------------------
List Archives: http://www.freelists.org/archives/exchangelist/  
MSExchange Newsletter: http://www.msexchange.org/pages/newsletter.asp 
MSExchange Articles and Tutorials:
http://www.msexchange.org/articles_tutorials/ 
MSExchange Blogs: http://blogs.msexchange.org/ 
-------------------------------------------------------
Visit TechGenix.com for more information about our other sites:
http://www.techgenix.com 
-------------------------------------------------------
To unsubscribe visit http://www.msexchange.org/pages/exchangelist.asp
Report abuse to listadmin@xxxxxxxxxxxxxx 

-------------------------------------------------------
List Archives: http://www.freelists.org/archives/exchangelist/
MSExchange Newsletter: http://www.msexchange.org/pages/newsletter.asp
MSExchange Articles and Tutorials: http://www.msexchange.org/articles_tutorials/
MSExchange Blogs: http://blogs.msexchange.org/
-------------------------------------------------------
Visit TechGenix.com for more information about our other sites:
http://www.techgenix.com
-------------------------------------------------------
To unsubscribe visit http://www.msexchange.org/pages/exchangelist.asp
Report abuse to listadmin@xxxxxxxxxxxxxx

Other related posts: