Subject: WARNING - VIRUS ALERT No.41
Date: Saturday, 26 February 2000 18:05:20 GMT
VIRUS ALERT - W32/Pretty.worm.unp
W32/Pretty.worm.unp is the unpacked edition of the original "W32/Pretty.worm" Internet worm. AVERT has upgraded its risk assessment from low to MEDIUM--ON WATCH, due to a significant increase in prevalence. It infects Windows 95/98/NT systems.
W32/Pretty.worm.unp arrives via email from affected users who have also run this Internet worm. It appears as an attachment titled "Pretty Park.exe", with the icon of a character from the animated television series "South Park".
This worm will try to email itself automatically every 30 minutes to all email addresses listed in the Internet address book.
It will also attempt to connect to an IRC server and join a pre-determined IRC channel in such a way that the worm's author could use the IRC connection to retrieve such information as the computer name, registered owner, registered organization, system root path, and Dial Up Networking username and passwords.
**************************************************************************
Information - W32/Trinoo
W32/Trinoo is a 32-bit Intel-based version of a Denial of Service (DDoS) attack program previously published as source code. AVERT has assigned it a LOW risk assessment. However, new infections are being reported, and AVERT is watching it closely.
W32/Trinoo arrives as an email trojan attachment. When run, it will install itself on the host system, and it will run as a service at the next Windows startup. It will then listen for commands on a pre-designated UDP port.
This trojan does not present a serious
risk to individual users at this time, and no alert is being posted. However,
we want to make our subscribers aware that this trojan is out there, and
that it is, in principle, capable of launching a Denial of Service attack
from an infected machine.
We thank you ALL for your kind votes which made this site FIRST in two categories.
A 10 vote = Very Good
A 1 vote = Waste of cyber Space !
ALL those sending emails of thanks are kindly requested to indicate whether these are for publication.
IMPORTANT NOTICE:
ALL those who are receiving this advise
and in the "name" field they find 'FAILED' and a 6 or 8 digit figure
after it, should be advised that at least once, emails to that address
have been received back by us. As the list of subscribers now exceeds 100,000, and since this
is a free service, we kindly urge you to become a registered
subscriber to this service and ensure delivery by subscribing under
a reliable email address. WE REGRET THAT AS AFTER THIS ISSUE,
ALL ADDRESSES THAT ARE NOT DELIVERABLE WILL BE REMOVED FROM THE LIST.
DISCLAIMER:
The information in this bulletin is provided "AS IS" without warranty
of any kind. In no event shall we be liable for any damages whatsoever
including direct, indirect, incidental, consequential, loss of business profits
or special damages.
PLEASE ADVISE ALL YOUR FRIENDS ON YOUR LIST
PLEASE ALSO NOTE THE FOLLOWING:
1) You are currently SUBSCRIBED to our mailing list
2) If you are receiving more than one copy of this warning please click here
3) If you DO NOT wish to receive anymore of these alerts, please click here
4) YOUR friends are also welcome to be on the VIRUS ALERT but an email has to be
sent to the Webmaster by themselves so that a record of all requests can be kept in case
somebody cries "SPAM" ! Simply click here
and send the email as it appears.
5)THIS IS A FREE SERVICE RUN IN THE PUBLIC INTEREST BY
6) ALSO PLEASE BE ADVISED THAT YOUR EMAIL WILL
NEVER BE SOLD, EXCHANGED OR IN ANYWAY WHATSOEVER DISCLOSED TO ANYBODY ELSE.
******
Fabian Brincat
Webmaster
Fabian Enterprises Ltd.
SEE PREVIOUS
VIRUS ALERT
RETURN TO VIRUS ALERT
MAIN INDEX
©ALL MATERIAL IS PROTECTED BY COPYRIGHT LAWS AND MAY NOT BE REPRODUCED IN ANY FORM WHATSOEVER WITHOUT THE PRIOR WRITTEN CONSENT OF THE WEBMASTER.
