W32/Wallon.worm

[kronas]

W32/Wallon-A is an email worm. The worm sends mail containing a deceptive link. The link appears to direct the user to drs.yahoo.com/<user's domain>/NEWS but in fact points to a location on another website.
The website that the user is directed to utilises Trojan downloaders and exploits to download and run a copy of W32/Wallon-A.

The Trojans used and installed during the infection process are:
Troj/Psyme-V, Troj/StartPa-HF, Troj/Dloader-JK and Dial/Top69-A.

sophos:

http://www.sophos.com/virusinfo/anal...32wallona.html


symantec: in depth removal and exploitation information of microsoft patches:

MS04-004 and MS04-013

http://securityresponse.symantec.com...llon.a@mm.html

[homealone]

ah that reminded me to update my AV - thanks Kronas

[paulyoung666]

Originally Posted by homealone

ah that reminded me to update my AV - thanks Kronas

and me too