Two heads up are better than and Optix alerts

Discussion in 'malware problems & news' started by Nancy_McAleavey, Oct 6, 2005.

Thread Status:
Not open for further replies.
  1. Nancy_McAleavey

    Nancy_McAleavey Expert Member

    Feb 10, 2002
    Voorheesville, NY, USA
    We've received and analyzed the latest worm, it's beginning to propagate widely. It appears as a ZIP attachment , typically or Upon opening it creates its folder, searches the HD for addresses and propagates in outbound email (similar to Netsky), creating a large amount of disk activity in the process. Variants of this worm are beginning to appear as well. We've seen 5 variants (all detected as by BOClean) so far today. Others will likely follow BOClean with their detections.

    A private build of Optix has been reported propagating through corporate network sites and AOL IM (exploiting the MSJET hole as well as port 445 and other usual exploits) as CRRSCR.EXE and CRRSCR32.EXE. There are a large number of Optix repacks circulating in the wild as well, BOClean is detecting these as Optix.1.3.3, others may detect as other variants.
Thread Status:
Not open for further replies.