Top 10 malware reported to Sophos in November 2004

Exploit-IframeBO is located on VIL at: http://vil.nai.com/vil/content/v_129629.htm

November 04, 2004 (IDG News Service) -- Microsoft Corp. is investigating reports of a serious security flaw in Internet Explorer but has not yet seen malicious code that exploits the reported vulnerability.

Security experts earlier this week warned that code exploiting a newly discovered security hole in Internet Explorer is circulating on the Internet. The code exploits a buffer overflow vulnerability in Internet Explorer 6 and has been confirmed on PCs running Windows XP with Service Pack 1 and Windows 2000, according to Danish security company Secunia.

The U.S. Computer Emergency Readiness Team (CERT) issued an alert similar to the Secunia advisory. CERT warns that in addition to the Web browser, applications such as e-mail clients that rely on browser controls may also be vulnerable. Attackers could gain complete control of a victim's computer by exploiting the flaw, according to Secunia and CERT.

more..
 

W32/Mydoom.ag@MM is located on VIL at: http://vil.nai.com/vil/content/v_129630.htm

A new version of MyDoom uses an unpatched flaw in Microsoft's Internet Explorer to spread, antivirus companies warned on Monday.

The recently discovered vulnerability in the browser software allows the offshoot to infect a PC after a user clicks on a link, according to advisories from security software makers Symantec and McAfee. The program sneaks past antivirus applications that detect malicious software by scanning e-mail messages with attached programs.

The companies said they had only detected a few instances of the infector, which is labelled MyDoom.AG by McAfee and MyDoom.AH by Symantec.

more...

Information about W32/Golten.worm is located on VIL at: http://vil.nai.com/vil/content/v_129974.htm

http://vil.nai.com/vil/content/v_129471.htm

A worm which exploits curiosity about the death of Yasser Arafat is the first to exploit the known Extended MetaFiles vulnerability.

Aler is a network worm that was widely bulk-mailed with the subject "Latest News about Arafat!!!". These infected emails had two attachments, one a clean JPEG file and the other an infected EMF file, according to anti-virus firm F-Secure.

The EMF file exploits a well-known Windows vulnerability (MS04-032) to install the worm onto systems when the attachment is opened.

more...

Information about W32/Yanz.a@MM is located on VIL at: http://vil.nai.com/vil/content/v_130045.htm

Information about W32/Yanz.b@MM is located on VIL at: http://vil.nai.com/vil/content/v_130137.htm

Information about W32/Anzae.a@MM is located on VIL at: http://vil.nai.com/vil/content/v_130139.htm

Information about W32/Anzae.b@MM is located on VIL at: http://vil.nai.com/vil/content/v_130140.htm

Information about W32/Anzae.c@MM is located on VIL at: http://vil.nai.com/vil/content/v_130141.htm

Five new worms target surfers
November 23, 2004
Claire Woffenden

 

more...

Email worm poses as Osama videogram

Emails claiming to contain video clips of terrorist mastermind Osama bin Laden are likely to be example of a new computer worm.

The Famus-F worm normally arrives in the form of a bilingual English and Spanish email, with the subject line "More terrorism this year". The message body states: "Last speech from Bin Laden. Please forwards this video to everybody." and includes a password - "cnn".
 

Read more here...