Re: [Snort-sigs] New Worm / Virus - WORM_MIMAIL.R?

[Joe Stewart <jstewart () lurhq com>]

On Monday 26 January 2004 4:42 pm, sam () neuroflux com wrote:
> All:
>
> We are experiencing what appears to be a new varient of the MIMAIL
> virus. We've had several machines infected now, and I've created a
> quick signature:

Although Mimail.Q did also come out today, what you're describing is
Mydoom/Novarg, which is spreading more rapidly than Mimail from the 
looks of it. Details from the AV companies are sketchy at this point, 
but, aside from spreading via SMTP and KaZaA, the copy I looked at 
appears to start up 63 threads all requesting the index page of 
www.sco.com every 300 milliseconds.

-Joe

-- 
Joe Stewart, GCIH 
Senior Security Researcher
LURHQ http://www.lurhq.com/



-------------------------------------------------------
The SF.Net email is sponsored by EclipseCon 2004
Premiere Conference on Open Tools Development and Integration
See the breadth of Eclipse activity. February 3-5 in Anaheim, CA.
http://www.eclipsecon.org/osdn
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users