Codezwiz >> Forums >> The Board >> Net virus can strike unseen

Originally posted by Kelly_Hero:

Both links above for Chilton Preview work.

To turn off the preview pane in Outlook, click on View. Click on Preview Pane and it will turn it off if it is on.

Kelly

Great advice Kelly, I have always turned the preview pane off...what a stupid thing to put in an e-mail proggie anyway...as if Microsoft isn't aware of viruses.

A fast-spreading worm let loose on the Internet Saturday, crawled through a vulnerability in Internet Security Systems' BlackICE firewall, has infected between 10,000 and 50,000 systems worldwide, and can trash infected hard drives.
The worm--dubbed "Witty," for a comment embedded in its code--exploits a stack overflow vulnerability within BlackICE that was disclosed just two days before the worm first appeared.

Unlike most other worms, Witty doesn't need human interaction to spread. Rather than rely on users to open a file attachment--the typical way worms propagate--Witty simply scans for vulnerable systems, then uses UDP port 4000 to infect the machine. This auto-spread strategy was last used to wreak havoc by 2003's MSBlast worm.

Witty is particularly dangerous, said experts, because after it executes, it opens a random drive on the PC and writes 65KB of data to a random location on the disk. It repeats that process until the system is rebooted or the computer crashes.

"This worm is highly malicious, slowly destroying the systems it infects," said security firm Lurhq, in an alert posted on its Web site. "Rather than simply executing a 'format C:' or similar destructive command, the worm slowly corrupts the file system while it continues to spread. Any infected machine will likely have its operating system and partition data destroyed along with most files on the physical drives, depending on how long the worm runs on the machine."

Internet Security Systems said its analysis indicated that only about two percent of its customers could be open to Witty's attack, but other analysts have tagged the number of infected machines at significant levels.

"It's unlikely that many computers will be patched against this vulnerability at this time," said Ken Dunham, the director of malicious code research at iDefense, in an e-mailed statement. "Early data suggests about 10,000 infected computers worldwide." Others have put forward the number of 50,000 infected machines.

Experts such as Dunham urged ISS customers to disable the firewall until it has been patched, and, where feasible, block traffic on UDP port 4000. ISS recommended that infected systems be disconnected from the network to stop the worm's spread.

Register

Hey Red,
Would you mind if I copy and pasted your post about the virus (Witty) on my site for a message to my members?

RedWolf111

spread the word m8

Register

Thanks bud. Got it posted

Just wanted to make sure you didn't mind me posting that word for word. Looks like you spent some time typing it out ...lol

RedWolf111

P.S. Like the new "Kevin" sig. Good thing he has a hard head...lol

Yea, we have a lot in common