Any info on the virus?

This is what we got from company security:

Subject:Virus Outbreak (RealVNC)
Message:GTRC,
Forwarding case to Site Support to have the system reimaged and cleaned.
To summarize, the worm looks for any systems running RealVNC versions
4.1.1 and below, and if it finds one it uses an exploit to log into the system without a
username or password. Once on the system it downloads a rootkit, and begins to spread to other systems.

Once the system is infected, the new rootkit disables any AV scan running, and makes it very difficult to remove. We recommend that the machines be rebuilt if they are infected, until a proven method is discovered to remove the rootkit.

Infosec has blackholed the command and control server at this point, so no systems are under remote control, however if the DNS record changes, the machines will reconnect to the c&c server.

Infosec is in the process of scanning the network and identifying all systems with this virus signature. As a result, cases will be generated for remediation and assigned to On Site Services.

Type Trojan

W32/Tilebot-JS is a backdoor worm for the Windows platform which allows a remote intruder to gain access and control over the computer.

RealVNC

A flaw exists RealVNC server v4.1.1 and older which allows an attacker to override RealVNC server-side authentication. This could result in the attacker gaining remote control over systems running RealVNC server.

[link|http://www.purdue.edu/securepurdue/steam/newsDetail.cfm?NewsID=59|http://www.purdue.ed...ail.cfm?NewsID=59]

* RealVNC is currently not a "company" Supported application. We recommend removing or upgrading to the latest secure version.

This link also talks about it:
[link|http://www.symantec.com/avcenter/attack_sigs/s21641.html|http://www.symantec...._sigs/s21641.html]

HTH

Post #290,533 by Silverlock 8/9/07 9:11:10 AM Reply	Any info on the virus? Rootkit, backdoor, worm? Does your anti-virus identify it or are you finding it through other means? I'm concerned about this because I know that VNC is used in several spots in my company, so any info I can gather and submit to our security team would be appreciated. ----------------------------------------- Atheism is a religion in the same sense that not collecting stamps is a hobby.
Post #290,539 by hnick 8/9/07 10:27:03 AM Reply	Re: Any info on the virus? This is what we got from company security: Subject:Virus Outbreak (RealVNC) Message:GTRC, Forwarding case to Site Support to have the system reimaged and cleaned. To summarize, the worm looks for any systems running RealVNC versions 4.1.1 and below, and if it finds one it uses an exploit to log into the system without a username or password. Once on the system it downloads a rootkit, and begins to spread to other systems. Once the system is infected, the new rootkit disables any AV scan running, and makes it very difficult to remove. We recommend that the machines be rebuilt if they are infected, until a proven method is discovered to remove the rootkit. Infosec has blackholed the command and control server at this point, so no systems are under remote control, however if the DNS record changes, the machines will reconnect to the c&c server. Infosec is in the process of scanning the network and identifying all systems with this virus signature. As a result, cases will be generated for remediation and assigned to On Site Services. Type Trojan W32/Tilebot-JS is a backdoor worm for the Windows platform which allows a remote intruder to gain access and control over the computer. RealVNC A flaw exists RealVNC server v4.1.1 and older which allows an attacker to override RealVNC server-side authentication. This could result in the attacker gaining remote control over systems running RealVNC server. [link\|http://www.purdue.edu/securepurdue/steam/newsDetail.cfm?NewsID=59\|http://www.purdue.ed...ail.cfm?NewsID=59] * RealVNC is currently not a "company" Supported application. We recommend removing or upgrading to the latest secure version. This link also talks about it: [link\|http://www.symantec.com/avcenter/attack_sigs/s21641.html\|http://www.symantec...._sigs/s21641.html] HTH
Post #290,544 by Silverlock 8/9/07 12:30:11 PM Reply	Thanks, forwarded. ----------------------------------------- Atheism is a religion in the same sense that not collecting stamps is a hobby.

Welcome to IWETHEY!