Large scale infection of many Windows systems. Compromise exploits a vulnerability with NAV and installs a version of the Hupigon/Blackbird backdoor. Malware is recognized by only a few AV engines -- NAV does not recognize the infection.
A very few users have been tricked into installing a "FreeVideo" Trojan. The Trojan installs a root-kit and direct DNS queries to a rogue server in Ukraine -- we alarm the DNS traffic to notify users who may be compromised.
Worms are actively exploiting MS06-040: Vulnerablity in Server Service (8-Aug-2006). We can test and identify some systems (Windows XP and 2000 with no firewall) where the patch has not been applied. Vulnerable systems should be firewalled and patched.
All mail servers should be configured to require encryption before users authenticate to relay mail. Otherwise users expose their password in the clear and that might lead to a compromise.
From June 1-19, 2006 UWdir: the campus directory would provide the email address of users who had requested that no information be published.
Snort alarms a RealVNC authentication bypass flaw -- an attacker obtains access to vulnerable systems without a password. We have seen a few compromises on Unix and Windows systems.
Snort alarms a Trojan that SOPHOS calls Troj/Torpig-R -- a few compromises detected, some advice on cleanup.
Snort alarms TrendMicro BKDR_HAXDOOR.DI Trojan -- a few compromises detected, some advice on cleanup.
Windows systems that offer file and print services but do not protect the Administrator account are easily compromised. We alarm systems we find and give them some advice on how to protect their system.
Blackworm is a widespread malicious worm infecting hundreds of thousands of systems around the world. We have seen the infection here and have installed an alarm based on Snort to detect systems which may be compromised.
phpBB 2.0.19 was released on 30-Dec-2005. Exploit code for version 2.0.17 and earlier was released on 24-Dec-2005. We scanned for and found several systems offering phpBB services which report vulnerable version numbers.