topic Re: “Here you have” Virus (aka W32/VBMania@MM) in General Topics

“Here you have” Virus (aka W32/VBMania@MM)

grant_sturgis — Fri, 10 Sep 2010 15:14:50 GMT

New virus, described here:

http://www.avertlabs.com/research/blog/index.php/2010/09/09/widespread-reporting-of-here-you-have-virus/

Is this virus recognized by the PAN devices? I'm not sure how to look that up, or I would do so myself.

If not, any thoughts on mitigating risk? I don't see .scr files in file blocking.

Thanks,

Grant

--------------

Re: “Here you have” Virus (aka W32/VBMania@MM)

blacksan — Fri, 10 Sep 2010 15:21:25 GMT

Palo Alto Web site > Support > Threat Database
drop down and select Virus.

I was just there looking for the same thing.

Re: “Here you have” Virus (aka W32/VBMania@MM)

grant_sturgis — Fri, 10 Sep 2010 15:29:19 GMT

Thanks, it looks to me like it's not recognized.

Any thoughts on mitigation?

Re: “Here you have” Virus (aka W32/VBMania@MM)

kbaldwin — Fri, 10 Sep 2010 15:31:13 GMT

It might be listed under a different name. Trend Micro recognizes it as WORM_MEYLME.B.

Re: “Here you have” Virus (aka W32/VBMania@MM)

twilson — Fri, 10 Sep 2010 15:32:10 GMT

I don't see anything on any virus. You would think you could just select from the drop down and hit enter and it would pull up a list, but I get nothing, even when I put something in there still nothing.

Re: “Here you have” Virus (aka W32/VBMania@MM)

grant_sturgis — Fri, 10 Sep 2010 15:38:35 GMT

unfortunately, no.

Re: “Here you have” Virus (aka W32/VBMania@MM)

grant_sturgis — Fri, 10 Sep 2010 15:39:26 GMT

if you're not seeing anything, you're doing it wrong.

type w32 , change type to virus, hit find, and see an enormous list.

Re: “Here you have” Virus (aka W32/VBMania@MM)

bpappas — Fri, 10 Sep 2010 15:48:28 GMT

This was slated to be included in last night's emergency Threat/AV content release for PAN OS 3.1.x.

PAN OS 3.0.x will be addressed with next Tuesday's content release.

Re: “Here you have” Virus (aka W32/VBMania@MM)

KatanaNZ — Tue, 14 Sep 2010 08:24:49 GMT

I still dont see this added into the threat database...is it known by a different name in Palo Alto land?

Re: “Here you have” Virus (aka W32/VBMania@MM)

migration — Tue, 14 Sep 2010 08:44:18 GMT

Hi,

Coverage for "Here you have" virus is as follows:

3.1

Virus Name: Trojan/Win32.swisyn.bofj

Content release: 271 (daily content release)

Release date: 5th August

Virus Name: Trojan/W32.swisyn.bxoh

Content Release: 299-364 (Daily A/V content update)

Release Date: 10th Sep

3.0

Virus Name: Trojan/Win32.swisyn.0804

Content release: 203 (weekly content release)

Release date: 25th August

Thanks,

Sandeep

Re: “Here you have” Virus (aka W32/VBMania@MM)

CWillms — Tue, 14 Sep 2010 20:04:32 GMT

Thanks,

What about the ability to block .scr files. It seems odd to me that there is a way to custmize nearly everything but not a way to add a file extention to the picklist???

Is .scr going to be included in some future release? Or the ability for the end user to add his own file extensions for blocking?

Re: “Here you have” Virus (aka W32/VBMania@MM)

bpappas — Tue, 14 Sep 2010 20:07:04 GMT

.scr files are included in the category "Portable Executables" (aka PE).

on my firewall i created a file block rule for the PE filetype in both directions.

Message was edited by: bpappas

Re: “Here you have” Virus (aka W32/VBMania@MM)

CWillms — Tue, 14 Sep 2010 20:13:13 GMT

Apparently the PA support guy I talked to yesterday did not know this... Is this knowledge in a document somewhere?

Re: “Here you have” Virus (aka W32/VBMania@MM)

KatanaNZ — Tue, 14 Sep 2010 20:43:00 GMT

How do we search for this? looking for VBmania, or "here you have" comes up with no results.

As much as vendors have their own names for malware, its pointless when we can't search for

it so we can let our customer know they're protected.