RE: getting rid of outbreaks and spam
Larry Seltzer opined:
> I agree that MyDoom demonstrates all too clearly the inherent
> limitations of conventional antivirus technology, but you're
> still unfair to it. First, the vast majority of attacks don't
> spread as far and as fast as MyDoom, and by the time one is
> likely to encounter it the AV companies have protection
> available, so conscientious users can protect themselves.
Correction 1: In the past the vast majority of attacks didn't
spread as far and as fast as MyDoom. That's no cause for complacency.
I think we can expect a lot more rapid-spreading viruses in the future.
Correction 2: Antivirus vendors weren't that fast in getting updates out
for MyDoom.A. Times below are in GMT, based on information posted on the
ClamAV Users mailing list by Diego d'Ambra, which cited PC-Welt as the
source.
ClamAV- 26.01 20:23 - Worm.SCO.A
McAfee (BETA) - 26.01. 21:20 - W32/Mydoom@MM (you'd have to have manually
downloaded this one for it to have been any use)
Symantec (BETA) - 26.01. 22:00 - W32.Novarg.A@mm
F-Prot - 26.01. 22:30 - W32/Mydoom.A@mm
Trend Micro - 26.01. 22:35 - WORM_MIMAIL.R
Trend (BETA) - 26.01. 22:35 - WORM_MIMAIL.R
RAV - 26.01. 23:00 - Win32/Novarg.A@mm
Norman - 26.01. 23:05 - MyDoom.A@mm
F-Secure - 26.01. 23:05 - W32/Mydoom.A@mm
Virusbuster - 26.01. 23:05 - I-Worm.Mydoom.A
AVG - 26.01. 23:15 - I-Worm/Mydoom
Avast - 26.01. 23:15 - Win32:Mydoom [Unp]
Kaspersky - 26.01. 23:30 - I-Worm.Novarg
AntiVir - 26.01. 23:30 - Worm/MyDoom.A2
Symantec - 27.01. 00:05 - W32.Novarg.A@mm
InoculateIT-CA - 27.01. 00:20 - Win32/Shimg.Worm
Command - 27.01. 00:20 - W32/Mydoom.A@mm
A2 - 27.01. 00:30 - Worm.Win32.Mydoom
Sophos - 27.01. 00:40 - W32/MyDoom-A
InoculateIT-VET - 27.01. 01:30 - Win32.Mydoom.A
Esafe - 27.01. 01:50 - Win32.Mydoom.a
Dr. Web - 27.01. 02:40 - Win32.HLLM.Foo.32768
Panda (BETA) - 27.01. 03:10 - W32/Mydoom.A.worm
McAfee - 27.01. 04:00 - W32/Mydoom@MM
Quickheal - 27.01. 04:00 - W32.Novarg
Bitdefender - 27.01. 04:00 - Win32.Novarg.A@mm
Panda - 27.01. 04:10 - W32/Mydoom.A.worm
Ikarus - 27.01. 08:35 - I-Worm.Mydoom
ClamAv detected our first incoming MyDoom.A at 00:20 GMT on January 27th,
well before some the main Antivirus vendors had patterns available for
autoupdate. Consider also that some vendors still work on a weekly update
cycle (e.g. McAfee) with updates more frequently only when a virus is
detected in some numbers in the wild. Bolting stable doors...
Cheers,
Phil
---------------------------------------------
Phil Randal
Network Engineer
Herefordshire Council
Hereford, UK