OSEC

Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com
 
Subject: Re: Newbie: what does this mean?
From: Joel Sing (jsingORIGIN.NET.AU)
Date: Sat Oct 14 2000 - 01:25:09 CDT


Hi All,

>Is this a variant of the QAZ.Worm?

No, I don't think so. According to Symantec, the QAZ.Worm (QAZ.Trojan) is a
Win32 companion virus and can only infect computers within the local
network (http://www.sarc.com/avcenter/venc/data/qaz.trojan.html). It also
has a backdoor and notifies the virus author of newly infected machines.

The Netlog Worm (VBS.Netlog or VBS.Network) on the other hand is a VBS
script that is designed to pick a random IP address and connect to it via
the Server Message Block (SMB) protocol. Unlike QAZ it doesn't have a
payload and will only clog up the network with attempts to map network
drives to various IP addresses. Symantec has a data sheet at
http://www.symantec.com/avcenter/venc/data/vbs.network.html

A friend of mine got hit with netlog a few months back. It's quite an
interesting script. It requires two things, firstly the machine has to have
Visual Basic Scripting (VBS) support and secondly, there must be at least
one share that is world writable (in order to be infected in the first place).

Hope this helps.

Cheers,

Joel

-------------------------------------------------------------------------
           => Joel Sing | jsingorigin.net.au | 0419 577 603 <=
-------------------------------------------------------------------------

"Danm tpyos." - Hank Leininger