Nancy McAleavey Posted October 6, 2005 Report Share Posted October 6, 2005 We've received and analyzed the latest Sober.ac worm, it's beginning to propagate widely. It appears as a ZIP attachment , typically pword_change.zip or photoattch.zip. Upon opening it creates its folder, searches the HD for addresses and propagates in outbound email (similar to Netsky), creating a large amount of disk activity in the process. Others will likely follow BOClean with their detections.A private build of Optix has been reported propagating through corporate network sites and AOL IM (exploiting the MSJET hole as well as port 445 and other usual exploits) as CRRSCR.EXE and CRRSCR32.EXE. There are a large number of Optix repacks circulating in the wild as well, BOClean is detecting these as Optix.1.3.3, others may detect as other variants. Quote Link to post Share on other sites
Matt Posted October 6, 2005 Report Share Posted October 6, 2005 Thanks for the info on those! Quote Link to post Share on other sites
Nancy McAleavey Posted October 7, 2005 Author Report Share Posted October 7, 2005 You're welcome! Quote Link to post Share on other sites
Recommended Posts
Join the conversation
You can post now and register later. If you have an account, sign in now to post with your account.