W32.HLLW.Anig / W32.Dfcsvc.worm

[dblairii]

The subject worm appeared today on Bugtraq. This appears to be a particularly nasty flavor of worm, complete with keylogging, backdoor, and ICQ functionality. Is there a signature that will pickup this activity? This inquiry is preemptive, I have not seen, nor do I have access to, a packet capture.

Anyone?

[mcerha]

We will include signatures for this worm in the S69 signature update due out this week. In the interim, Signature 3320 "SMB: ADMIN$ hidden share access attempt" will catch the worm scanning for open shares across the network.