A new worm that could exploit the Windows DCOM RPC (Distributed Component Object Model Remote Procedure Call) hole is spreading in the wild, reports Sophos. It is called Raleka.B.
<B>Kaspersky's top 20</B>
Kaspersky Labs has released its Top 20 virus list for last month. The top 10 follow, in decreasing order of occurrence and with the percentage of occurrences included:
1 I-Worm.Sobig (61.49%)
2 I-Worm.Mimail (4.6%)
3 I-Worm.Tanatos (3.9%)
4 Worm.Win32.Lovesan (3.17%)
5 I-Worm.Klez (1.09%)
6 I-Worm.Lentin (0.67%)
7 Worm.P2P.SpyBot (0.66%)
8 Macro.Word97.Thus (0.60%)
9 Macro.Word97.Saver (0.60%)
10 Backdoor.BeastDoor (0.50%)
Already penetrated by Blaster in recent weeks, the RPC vulnerability was first reported by Microsoft on 16 July, and is considered critical.
Sophos reports that there are three variants of Raleka. The first was discovered three days ago.
The vendor says it has intercepted "multiple copies" of Raleka in the wild. Information on the latest variant is available here.
"No further details are available regarding the third variant, Raleka.C, at the time of sending out this press notice," Sophos reports. However, it confirms Raleka spreads via the DCOM RPC vulnerability, much like the Blaster worms.
"Raleka.B ... has the capabilities of becoming reasonably widespread over the next few days," adds the company.
"New worms like Welchia/Nachi as well as aggressive patching are helping to patch vulnerable computers. As a result, this and future DCOM RPC exploiting worms will likely have less success than former variants exploiting the same vulnerability.
Hidden surprise
Sophos reports Raleka has a hidden surprise. "It also installs a backdoor Trojan horse and can update itself via a remote website."
<B>August "worst virus month in history"</B>
Central Command has released its monthly listing of the top twelve viruses for August.
1 Worm/Sobig.F (76.8%)
2 Worm/Lovsan.A/Blaster (6.4%)
3 Worm/MiMail.A (5.1%)
4 Worm/Nachi.A (4.0%)
5 Worm/Klez.E (including G) (2.1%)
6 Worm/Dumaru.A (2.0%)
7 Worm/Sobig.A (0.9%)
8 Worm/BugBear.B (0.7%)
9 W32/Sircam.A (0.6%)
10 Worm/Yaha.E (0.5%)
11 Worm/Sobig.C (0.4%)
12 Worm/Sobig.E (0.2%)
Anti-virus commentators say they "fully expect a busy spring, with a new variant of Sobig on the horizon, and multiple RPC-based code in the wild."
Bret Myroff, CEO of NetXactics, South African distributor for Sophos products, says "users and companies should remain on guard and put systems in place to protect against future attacks."
Backdoor.IRC.RPCBot.C is a Backdoor Trojan Horse that gives its creator full control of your computer. The Trojan's creator can also instruct the Trojan to use the DCOM RPC vulnerability (described in Microsoft Security Bulletin MS03-026) to spread itself.
Symantec has issued an advisory too, terming the Trojan it identified Backdoor.IRC.RPCBot.
With a low number of infections and sites, geographical distribution is low, says Zubeir Shah, local Symantec PR manager.
The vendor advises users and admin staff to follow a number of best practices to avoid infection. Go here for details.
Share
