NEWS FROM THE LAB - Saturday, March 20, 2004

New automatic network worm Posted by Mikko @ 08:52 GMT

A new worm (known so far as "Blackworm") has been found. This one spreads through direct network connections, targetting machines that are running BlackIce security software.

If you're running BlackIce, we recommend disconnecting from the network immediatly and getting the patch from the vendors website on another computer, then transferring it on a massmedia device to the machine for an update.

More information at Incidents.org.

Number of infected computers right now seems to be several thousands. The worm is generating substantial amounts of traffic to random UDP ports (with source port of 4000).