Outbreak Name: W32/Stration-T*

Outbreak Date: 9-10-06

Dangerous Worm Downloads Spyware, Turns off AV Protection Outbreak Filters Protects Users 2 hours and 11 minutes Before First AV Signature

Background

IronPort's Virus Outbreak Filters protects customers within the critical period between the first exploit of a virus outbreak and the release of an AV signature. During the recent Worm variant outbreak, Outbreak Filters protected customers 2 hours and 11 minutes before traditional AV vendors** provided protection.

Potential Damage from Outbreak

W32/Stration-T is a dangerous worm that spreads by sending itself to email addresses found on the infected computer. Once opened, the worm changes the systems' HOSTS files to prevent them from accessing anti-virus updates that would protect against the worm. The worm also opens a backdoor that remote hackers can use to take over the computer. Once taken over, hackers can use the computer to send spam and host spyware. Remote hackers can also install key loggers and screen scrapers onto the infected PC to steal personal, confidential and financial information without the user's knowledge.

Timeline

* As named by Sophos.
** Calculated as publicly published signatures from the following vendors: Sophos, Trend Micro, Computer Associates, F-Secure, Symantec and McAfee. If signature time is not available, first publicly published alert time is used.