Ross
Well-known member
W32.Squirm@mm
Discovered on: August 19, 2003
Last Updated on: August 20, 2003 12:18:41 PM
http://www.symantec.com/avcenter/venc/data/[email protected]
W32.Squirm@mm is an Internet worm that is written in C++ and is packed with PEBundle. It attempts to spread using the following methods:
By email, it sends itself to the contacts in the Microsoft Outlook Address Book, with the following message:
From: [email protected]
Subject: Microsoft Security Bulletin
Message:
Unchecked Buffer in Windows Explorer Could Enable System Compromise (329390)
Summary
Who should read this bulletin: Customers using Microsoft Windows 95,98,2K,ME,XP
Impact of vulnerability: Run code of an attacker's choice
Maximum Severity Rating: Critical
Recommendation: Customers using Microsoft Windows 95,98,2K,ME,XP should apply the patch immediately.
Attachment: patch.zip or patch_329390.exe
Through file sharing applications, including KaZaA, Morpheus, eDonkey, Grokster, LimeWire, GNucleus, BearShare, Direct Connect, and ICQ, by placing itself in their default shared folders, if the programs are installed.
By using DCC, the worm sends in IRC.
The worm sends a notification to its author when a host is infected and listens on port 61282 for a connection.
Infection Length: 104,448
Systems Affected: Windows 2000, Windows 95, Windows 98, Windows Me, Windows NT, Windows XP
Systems Not Affected: Linux, Macintosh, Microsoft IIS, OS/2, UNIX, Windows 3.x
Everyone Please Remember That Microsoft Does Not Email Patches. You Must Go To Them To Get The Patch. Do Not Be Deceived By This Worm!
Discovered on: August 19, 2003
Last Updated on: August 20, 2003 12:18:41 PM
http://www.symantec.com/avcenter/venc/data/[email protected]
W32.Squirm@mm is an Internet worm that is written in C++ and is packed with PEBundle. It attempts to spread using the following methods:
By email, it sends itself to the contacts in the Microsoft Outlook Address Book, with the following message:
From: [email protected]
Subject: Microsoft Security Bulletin
Message:
Unchecked Buffer in Windows Explorer Could Enable System Compromise (329390)
Summary
Who should read this bulletin: Customers using Microsoft Windows 95,98,2K,ME,XP
Impact of vulnerability: Run code of an attacker's choice
Maximum Severity Rating: Critical
Recommendation: Customers using Microsoft Windows 95,98,2K,ME,XP should apply the patch immediately.
Attachment: patch.zip or patch_329390.exe
Through file sharing applications, including KaZaA, Morpheus, eDonkey, Grokster, LimeWire, GNucleus, BearShare, Direct Connect, and ICQ, by placing itself in their default shared folders, if the programs are installed.
By using DCC, the worm sends in IRC.
The worm sends a notification to its author when a host is infected and listens on port 61282 for a connection.
Infection Length: 104,448
Systems Affected: Windows 2000, Windows 95, Windows 98, Windows Me, Windows NT, Windows XP
Systems Not Affected: Linux, Macintosh, Microsoft IIS, OS/2, UNIX, Windows 3.x
Everyone Please Remember That Microsoft Does Not Email Patches. You Must Go To Them To Get The Patch. Do Not Be Deceived By This Worm!
