- Related Stories
-
Sophos declares Netsky-P worst virus of 2004
December 8, 2004 -
Police question man over Slammer worm
December 1, 2004 -
HP to launch 'virus throttling' software
November 30, 2004 -
Web on watch for common enemies
November 29, 2004 -
Sober worm variant shimmies
November 19, 2004
The Maslan worm appears to be politically motivated, with infected machines intended to launch a denial-of-service attack against Web sites run by Chechen separatist supporters, antivirus firm Sophos said in an advisory Thursday.
According to Symantec, W32.Maslan.C@mm is a mass-mailing worm that opens a back door and exploits system vulnerabilities on a compromised computer. The worm also steals passwords using a keylogger. In addition, it attempts to attack a series of firewalls and antivirus settings on an infected machine.
The virus controls which e-mail addresses it spreads to, avoiding most Web mail addresses and any others that may report to antivirus or filtering companies, apparently a crude attempt to avoid detection. Panda, Sophos and Symantec have all been blacklisted by the worm, along with words such as "abuse," "privacy" and "spam," which, if they appear an e-mail address, may be an indication of an address used to report unsolicited or malicious mail.
Currently, the e-mail spreading in the wild has the subject line "123" or "12345" and an attached file called "Playgirls2.exe" or "Playgirls_2.exe," security companies said.
Sophos said the virus is timed on the first day of each month to attempt to launch a denial-of-service attack intended to swamp the targeted Web sites with Internet traffic.
Will Sturgeon of Silicon.com reported from London.
See more CNET content tagged:
Sophos Plc., antivirus company, worm, denial of service, antivirus







It's got some good stories and links - all without viruses.