W32.Feebs

W32.Feebs is a detection for a family of mass-mailing worm that also spreads through file-sharing networks and lowers security settings on the compromised computer. The worm may also send confidential information to a remote attacker via FTP.

The worm variant arrives as an email attachment with an .HTA extension. Once the .HTA file is viewed, a malicious JavaScript then drops or downloads a copy of the worm executable.

Protection

• Initial Rapid Release version January 8, 2006
• Latest Rapid Release version January 8, 2006
• Initial Daily Certified version January 8, 2006
• Latest Daily Certified version January 15, 2008 revision 017
• Initial Weekly Certified release date January 11, 2006

Click here for a more detailed description of Rapid Release and Daily Certified virus definitions.

Threat Assessment

Wild

• Wild Level: Medium
• Number of Infections: 50 - 999
• Number of Sites: 10+
• Geographical Distribution: Low
• Threat Containment: Easy
• Removal: Moderate

Damage

• Damage Level: Medium
• Payload: May send a copy of itself to addresses gathered from the compromised computer.
• Compromises Security Settings: May lower security settings by stopping security-related services.

Distribution

• Distribution Level: High
• Subject of Email: Varies
• Name of Attachment: Varies
• Ports: TCP 80