[virusinfo] Sophos Anti-Virus IDE alert: Troj/DDosSmal-B
- From: "Mike" <mikebike@xxxxxxxxx>
- To: virusinfo@xxxxxxxxxxxxx
- Date: Wed, 21 Apr 2004 08:09:54 -0700
From; Sophos Alert System:
Name: Troj/DDosSmal-B
Type: Trojan
Date: 21 April 2004
A virus identity (IDE) file which provides protection is
available now from the Sophos website, and is incorporated into
the April 2004 (3.80) release of Sophos Anti-Virus.
At the time of writing, Sophos has received just one report of
this Trojan from the wild.
Note: The IDE issued for Troj/DDosSmal-B on 11:51 GMT in 19
February also contained detection for W32/Netsky-A, W32/Nachi-C,
W32/SdBot-FQ, W32/SdBot-HH, W32/SdBot-HI, W32/SdBot-HJ and
JS/NoClose-B. This IDE has now been updated to enhance detection
of W32/Nachi-C.
Information about Troj/DDosSmal-B can be found at:
http://www.sophos.com/virusinfo/analyses/trojddossmalb.html
Troj/DDosSmal-B is a Trojan which attempts a denial-of-service attack on a
website.
Troj/DDosSmal-B repeatedly sends random TCP/IP packets to diana23.dyndns.org
port 80 (HTTP). It does this for 10 minutes, then sets a timeout for 1
minute. After the timeout elapses, it goes back to the start (repeating the
10 minute flood).
In order to run automatically when Windows starts up the Trojan copies
itself to the file winsys.exe in the Windows folder and adds the following
registry entry:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run\winsys
This IDE file also includes detection for:
W32/Netsky-A
http://www.sophos.com/virusinfo/analyses/w32netskya.html
W32/Nachi-C
http://www.sophos.com/virusinfo/analyses/w32nachic.html
W32/SdBot-FQ
http://www.sophos.com/virusinfo/analyses/w32sdbotfq.html
W32/SdBot-HH
http://www.sophos.com/virusinfo/analyses/w32sdbothh.html
W32/SdBot-HI
http://www.sophos.com/virusinfo/analyses/w32sdbothi.html
W32/SdBot-HJ
http://www.sophos.com/virusinfo/analyses/w32sdbothj.html
JS/NoClose-B
http://www.sophos.com/virusinfo/analyses/jsnocloseb.html
Download the IDE file from:
http://www.sophos.com/downloads/ide/ddossm-b.ide
Download all the IDE files available for the current version of
Sophos Anti-Virus in a single compressed file. The file is
available in two formats:
Zip file:
http://www.sophos.com/downloads/ide/ides.zip
Self-extracting file:
http://www.sophos.com/downloads/ide/ides.exe
Read about how to use IDE files at
http://www.sophos.com/downloads/ide/using.html
---------------------------------------------------------------------
Mike ~ It is a good day if I learned something new.
Editor MikesWhatsNews see a sample on my web page
http://www3.telus.net/mikebike
<mikeswhatsnews-request@xxxxxxxxxxxxx?Subject=subscribe>
http://www3.telus.net/mikebike/worm_removal.htm
See my Anti-Virus pages http://virusinfo.hackfix.org/index
<virusinfo-request@xxxxxxxxxxxxx?Subject=subscribe>
A Technical Support Alliance and OWTA Charter Member
Other related posts:
