Threat Level: green Handler on Duty: Pedro Bueno

SANS ISC InfoSec Handlers Diary Blog


Sign Up for Free!   Forgot Password?
Log In or Sign Up for Free!

Blast from the future?

Published: 2008-09-12
Last Updated: 2008-09-12 15:31:22 UTC
by Mark Hofman (Version: 1)
0 comment(s)

It is 1995 and users are complaining that a weird dialog box is popping up in their word document.  The first macro virus was doing the rounds.  Fast forward to September 2008 and yes you guessed it new word macro viruses are doing the rounds.   They have been updated somewhat.  Rather than pop up a little dialog box it is behaving more like the traditional downloaders and the road to pain afterwards.

Rechnung.doc has been around for a few days now and detection rates are pretty good, 23/36 (http://www.virustotal.com/analisis/0fc3a70eff0b9ec447794acbda2402e7).  So far seems to be mostly Europe.

However that is not the only one doing the rounds, Michael passed one along that seems to have fairly bad detect rates, which we've passed on to the AV vendors so detect rates should improve.

Mark H - Shearwater.

Keywords:
0 comment(s)
Diary Archives