I had no problem downloading CA's cleansing tool a short time ago.
My hat is off to CA for producing this tool and making it available
for free.
Regarding the SCO DDoS, it's so sad when a thief (of services)
decides to attack a blackmailer, in my opinion.
Best regards,
Bob Toxen, CTO
Fly-By-Day Consulting, Inc.
"Your expert in Firewalls, Virus and Spam Filters, VPNs,
Network Monitoring, and Network Security consulting"
bob_at_verysecurelinux.com (e-mail)
My recent talks on Linux security include:
at IBM's Linux Competency Center in New York City on Mar. 06 last year
at the Atlanta SecureWorld Expo in Atlanta on May 22 last year
at the Enterprise Linux Forum in Silicon Valley on June 04 last year
at Computer Associates' Atlanta Linux Security Summit on Sep. 16 last year
at Southeast Cybercrime Summit in Atlanta on Mar. 2-5 2004
at the FBI's Atlanta headquarters on Mar. 10 2004
Author,
"Real World Linux Security: Intrusion Detection, Prevention, and Recovery"
2nd Ed., Prentice Hall, (C) 2003, 848 pages, ISBN: 0130464562
Also available in Japanese, Chinese, and Czech.
On Mon, Jan 26, 2004 at 04:03:30PM -0800, tlarholm_at_pivx.com wrote:
> MiMail.R, also known as W32/Mydoom_at_MM (McAfee), Novarg (F-Secure),
> W32.Novarg.A_at_mm (Symantec), Win32.Mydoom.A (CA) and Win32/Shimg (CA), is
> a polymorphic variant that collects/spams/forges email addresses using
> its own SMTP engine, installs a backdoor (most likely for use by
> spammers) and engages in a DDoS attack against SCO.com by routinely
> sending 63 HTTP requests. It's send as a ZIP attachment containing an
> executable file with the file extension masked by numerous spaces.
>
> McAfee is calling this a High Outbreak worm, which definitely fits the
> bill according to the number of samples we are receiving.
>
> Is the SCO.com DDoS an attempt at distraction from the fact that this
> virus installs a proxy backdoor?
>
> CA used to have a removal tool at
>
> http://www3.ca.com/Files/VirusInformationAndPrevention/clnshimg.zip
>
> but it's no longer available.
>
> More information:
>
> http://us.mcafee.com/virusInfo/default.asp?id=mydoom
> http://www.trendmicro.com/vinfo/virusencyclo/default5.asp?VName=WORM_MIM
> AIL.R
> http://securityresponse.symantec.com/avcenter/venc/data/w32.novarg.a@mm.
> html
> http://www3.ca.com/solutions/collateral.asp?CT=27081&CID=54593
>
>
>
> Regards
>
> Thor Larholm
> Senior Security Researcher
> PivX Solutions
> 24 Corporate Plaza #180
> Newport Beach, CA 92660
> http://www.pivx.com
> thor_at_pivx.com
> Phone: +1 (949) 231-8496
> PGP: 0x5A276569
> 6BB1 B77F CB62 0D3D 5A82 C65D E1A4 157C 5A27 6569
>
> PivX defines "Proactive Threat Mitigation". Get a FREE Beta Version of
> Qwik-Fix
> <http://www.qwik-fix.net>
Received on Jan 28 2004
Intro
