Bloodhound.Exploit.4

Symantec antivirus products exclusively use the virus name Bloodhound.Exploit.4 when a potentially unknown virus is found using Symantec Bloodhound technology. Bloodhound technology consists of heuristic algorithms that are used to detect unknown viruses. The actual file that is detected under Bloodhound.Exploit.4 is likely to be a new worm or Trojan that uses the Microsoft Windows Workstation Service Remote Buffer Overflow Vulnerability.

Submit samples that are detected as Bloodhound.Exploit.4 to Symantec Security Response so that these new viruses and variants can be identified and assigned specific names. Then we can provide you with more information about their nature.

To learn how to submit a file, read the document for the type of Symantec antivirus product that you are using:

• Consumer products: If you are using a Symantec antivirus consumer product, such as Norton AntiVirus 2004, click here.
• Enterprise products: If you are using a Symantec antivirus enterprise (corporate) product, such as Norton AntiVirus Corporate Edition 7.0, click here.

Protection

• Initial Rapid Release version November 12, 2003
• Latest Rapid Release version August 20, 2008 revision 017
• Initial Daily Certified version November 12, 2003
• Latest Daily Certified version August 20, 2008 revision 016
• Initial Weekly Certified release date November 12, 2003

Click here for a more detailed description of Rapid Release and Daily Certified virus definitions.

Threat Assessment

Wild

• Wild Level: Low
• Number of Infections: 0 - 49
• Number of Sites: 0 - 2
• Geographical Distribution: Low
• Threat Containment: Easy
• Removal: Easy

Damage

• Damage Level: Low

Distribution

• Distribution Level: Low