"Email filtering company MessageLabs has issued an early warning to anti-virus vendors that a new mass-mailing worm may be on the march. The anti-virus community had at least eight hours from the start of Monday (GMT time) to prepare for the suspected new worm, according to MessageLabs. The filtering company says the timeframe is based on the head-start its vigil over email systems gives it over traditional anti-virus vendors.The company said the attachment was sufficiently different from other mass mailing worms in circulation - such as the MyDoom variants - for it to class the threat as new.
MessageLabs spokesperson, David Banes, said its scanning engine had filtered around 800 emails bound for its clients which carried a suspicious 12KB pay load. While the company is yet to carry out a detailed analysis of the code, there are indications its creators are seeding the email in preparation for a denial of service attack.
The attachment contains a mail engine, a list of domain names associated with Undernet.org and some parts of the code suggest it may be designed to communicate with a chat room. MessageLabs was unable to say whether the email's activity is concentrated in any geographical region.
MessageLabs said the threat alarm policy of its scanning engine, Sceptic, was guided by a number of criteria, including detection frequency and the characteristics of the threat."
Source:
silicon.com
Feb 16, 2004, 06:54 PM
