JackClark

New virus arrives in a msg with the subject line Hi.

Extra driver here www.californear.com/extra.dat

Users of McAfee ASaP should update now by double clicking their icon in the system tray.

More info later, bit busy with this one.

ChrisB

Keep us updated please Jack. Is it an attachment payload?

ChrisB

Just looked - .scr file.

JackClark

Look for and block if you can gone.scr

JackClark

Look for and block if you can gone.scr

ChrisB

Groupshield traps all .SCRs for us anyway.

ScoobyNet beats Enterprise SecureCast again

JackClark

That's almost funny

IanW

http://vil.nai.com/vil/virusSummary.asp?virus_k=99272

More info there

Jack,

whats the difference between Extra.dat and Super Extra.Dat ????

JackClark

Super contains an engine update as well.

IanW

Ahh same deal as superDat then!

already running 4160 so just the Extra Dat for me!

ozzy

OK,

Our company already runs DAT 4173 and Engine 4160, so why didn't it cure the virus on our system? I had to block the gone.scr file and luckily everyone has been briefed on NOT opening e-mails with those sorts of messages so no infected PC's/Servers.

Those updates on the NAI site are for the 4173 engine, but it clearly states you need 4174 to cure it. Anyone know where we can download the newer DAT file?

Stefan

JackClark

I've placed the extra.dat on my page in case our site is too busy. The link is in the first post of this thread. This virus was discovered today, your DAT files were produced last week.

ozzy

OK,

So although the DAT still reports itself as 4173, it is newer? I updated the PC here, but I'll go do the servers now and let you know.

Thanks,
Stefan

ozzy

Thanks for confirming things Jack.

Just updated our servers and ran a scan on the quarantined gone.scr files - now detects them as proper viruses and deletes them.

Stefan

JackClark

JackClark

4174 drivers will be posted shortly to cover this threat.

ChrisB

Just grabbing 4174 now.

Thanks for the heads up Jack - much appreciated

ChrisB

I think the rest of the world must be getting 4174 as well. 1KB a second...