New worm threat flagged

E-mail filtering company MessageLabs has issued an early warning to anti-virus vendors that a new mass-mailing worm may be on the march.The anti-virus community had around eight to 12 hours from around 1pm today to prepare for the suspected new worm, according to MessageLabs.

E-mail filtering company MessageLabs has issued an early warning to anti-virus vendors that a new mass-mailing worm may be on the march.

The anti-virus community had around eight to 12 hours from around 1pm today to prepare for the suspected new worm, according to MessageLabs. The filtering company says the timeframe is based on the head-start its vigil over e-mail systems gives it over traditional anti-virus vendors.

The company said the attachment was sufficiently different from other mass mailing worms in circulation -- such as the MyDoom variants -- for it to class the threat as new.

MessageLabs spokesperson, David Banes, said its scanning engine had filtered around 800 e-mails bound for its clients which carried a suspicious 12-kilobyte pay load.

While the company is yet to carry out a detailed analysis of the code, there are indications its creators are seeding the e-mail in preparation for a denial of service attack.

The attachment contains a mail engine, a list of domain names associated with Undernet.org and some parts of the code suggest it may be designed to communicate with a chat room.

MessageLabs was unable to say whether the e-mail's activity was concentrated in any geographical region.

MessageLabs said the threat alarm policy of its scanning engine, Sceptic, was guided by a number of criteria, including detection frequency and the characteristics of the threat.

Newsletters

You have been successfully signed up. To sign up for more newsletters or to manage your account, visit the Newsletter Subscription Center.
See All
See All