While the importance of data backup is a well-known cliché for business users, many businesses would rather stick to existing, limited, overly-convoluted and – in some cases – outdated practices than introduce more modern backup solutions to their organisation.
Trend Micro suspects MSBlast.D could be part of a virus writer’s game
- 19 August, 2003 15:51
<p>Sydney – Leading antivirus and content security company, Trend Micro, is considering the possibility that the current MSBlast.D variant may have been developed as part of a competition between rival virus writers.</p>
<p>“At the moment we are unsure as to the motivation for creating this new variant. It could be a game between two virus writers or a “white knight” attempting to help the situation – however - there is no such thing as a good worm as it is unsolicited, untested and uncontrolled,” said Joel Montgomery, Product Marketing Manager, Trend Micro Australia.</p>
<p>The new worm variant attempts to delete the original worm (WORM_MSBLAST.A, a/k/a Blaster, Lovsan) from infected systems and install Microsoft patches to repair the underlying vulnerability that enables both worms to spread.</p>
<p>“Customers should be aware that WORM_MSBLAST.D is considered a malicious code as it scans for unpatched systems and downloads itself to them without permission. The worm compromises security by opening Port 707, leaving systems open to further attacks. Infected machines consume large amounts of bandwidth downloading patches and scanning for new hosts, and the traffic is capable of slowing down and eventually overwhelming networks,” said Montgomery.
According to Montgomery, the following text strings visible in the worm body hint that the variant may have been created as part of a game.</p>
<p>=========== I love my wife & baby :-)~~~ Welcome Chian~~~ Notice: 2004 will remove myself:-)~~ sorry zhongli~~~=========== wins</p>
<p>Mr Montgomery also said that installing patches to the operating system without the administrator’s knowledge and approval is another serious ethical violation and could easily cause technical problems.</p>
<p>“For many users, the negative impact of the MSBlast.D is not offset by any possible benefit, as the worm’s patching efforts often fail. Users of Windows in languages other than English, Chinese and Korean receive no patches, nor do users who lack certain service packs,” said Montgomery.</p>
<p>The pattern file, Outbreak Prevention Policy and System Cleaner are all available now from Trend Micro.</p>
<p>Non Trend Micro users with Internet connections can use HouseCall, Trend Micro's free online virus scanner, at http://housecall.trendmicro.com/ The Trend Micro Virus Map displays information about worldwide virus trends based on actual virus infections detected by Trend Micro http://www.trendmicro.com/map/</p>
<p>About Trend Micro</p>
<p>Trend Micro is the world leader in providing centrally controlled server-based virus protection and content-filtering products and services. By protecting information that flows through Internet gateways, email servers and file servers, Trend Micro allows companies and service providers worldwide to stop viruses and other malicious code from a central point before they enter the network. Trend Micro was recently acknowledged as the worldwide leader in server-based antivirus in the IDC report "Antivirus Software 2002: A segmentation of the market". For more information visit www.trendmicro.com.au</p>