The worm itself is old, but a new variant has kicked up the detections again. Symantec just modified existing signatures, whereas McAfee added variant label to their signatures.
Definitions and IPS signatures are available now, if this is indeed W32.Changeup. We have the following protections in place for the latest version of W32.Changeup:
There is also a list of servers that can be locked at the firewall level, and advice on how to prevent the spread of autorun threats and lock down Windows network shares.
If anyone does encounter any suspicious files they feel may be related to this (or any other threat), please do submit them to Security Response for analysis!
Here are some good general recommendations on how to stay safe:
Comments 12 Comments • Jump to latest comment
Yes, see here:
https://www.symantec.com/security_response/writeup...
SEP Knowledge Base
Endpoint SWAT
But this is a year old.
The problem is all the companies use a different naming convention. So you would need to call Symantec as they probably have it internally.
SEP Knowledge Base
Endpoint SWAT
It looks very close to the W32.Changeup article update that Symantec released yesterday:
https://www-secure.symantec.com/connect/pt-br/blog...
The worm itself is old, but a new variant has kicked up the detections again. Symantec just modified existing signatures, whereas McAfee added variant label to their signatures.
Yep, looks to be the same
SEP Knowledge Base
Endpoint SWAT
I dont think yet,..
http://r.virscan.org/7d0c47e7183abd92ea3f58f0a587bec1
Good Luck!
Good Luck!
Generic BackDoor.wc
W32/Autorun.worm.aaeb
Macfee has relase the patch today any patch is relase by symantec......
When wil symantec release something for this?
Definitions and IPS signatures are available now, if this is indeed W32.Changeup. We have the following protections in place for the latest version of W32.Changeup:
There is also a list of servers that can be locked at the firewall level, and advice on how to prevent the spread of autorun threats and lock down Windows network shares.
With thanks and best regards,
Mick
Thank you for the response on this Mick2009!
Glad to help!
If anyone does encounter any suspicious files they feel may be related to this (or any other threat), please do submit them to Security Response for analysis!
Here are some good general recommendations on how to stay safe:
http://www.symantec.com/theme.jsp?themeid=stopping_malware&depthpath=0
With thanks and best regards,
Mick
A new blog post that will be of interest:
https://www-secure.symantec.com/connect/blogs/w32changeup-keeps-giving
With thanks and best regards,
Mick
Would you like to reply?
Login or Register to post your comment.