Re: cuebot-d infection method

Right on Matt.

This new breed of malware is all about patch management.

Simon

On 26 Aug 2005 at 16:20, matt wrote:

> Jeff Bryner wrote:
>
> > I've seen a couple cuebot-d infections over the last couple days and am
> > trying to track down the source of them. Has anyone seen enough of this
> > to know the universe of ways the pc gets initially infected?
> >
> > The pcs that have gotten infected have mcafee running on them  which
> > incorrectly picks it up as W32/Sdbot.worm.gen.by when a scan is
> > requested. It didn't seem to pick it up *until* a scan was requested.
> >
> > The writeup at http://www.sophos.com/virusinfo/analyses/w32cuebotd.html
> > fits the scenario, but it doesn't say exactly what the initial
> > infection vector is.
> >
> > Thanks for any help. 
> >
> > Jeff
> > CISSP, GCIH, GCFA
> >  
> Sdbot has many infection vectors and is easy to modify.  Usually as soon 
> as a new MS bug is discovered somebody mods it into sdbot or one of these
> variants.  I have seen an sdbot using about 20 different infection 
> methods from lsass, ntpass/share cracking to the new win2k bug.
>
> Regards
>
> Matt
> Learn Security Online, Inc.