[Mimedefang] Latest Worms and IE Exploits

[Sevo Stille]

Jeff Grossman wrote:
> I have been getting hit hard with the IE Exploit and the worm.gibe.f virus.
> Is anybody else getting hit hard last night and this morning with these?

Indeed. Only users that post to the Usenet seem to be affected, though - 
the worm is quite new in gathering its addresses from news servers. We 
currently see about 10-40/hr for each of our Usenet users. Which is 
pretty amazing, given that I'd have considered Usenet users more 
computer savy than the average.

My guess is that the unaccompanied and seemingly pointless Iframe mails 
I have seen over the past three weeks already were traces of the same 
worm using another spreading mechanism, so that there already were many 
affected systems before it switched to mailing itself to Usenet posters. 
It contains code to spread over Kazaa and ICQ as well. Another argument 
in favour of that would be that the affected hosts yesterday seemed to 
develop in a east to west swipe, which suggests a (local) time triggered 
dormant worm.

Sevo

-- 
Sevo Stille
sevo at radiox.de