“Here you have” Virus (aka W32/VBMania@MM)

[grant_sturgis]

New virus, described here:

http://www.avertlabs.com/research/blog/index.php/2010/09/09/widespread-reporting-of-here-you-have-vi...

Is this virus recognized by the PAN devices?  I'm not sure how to look that up, or I would do so myself.

If not, any thoughts on mitigating risk?  I don't see .scr files in file blocking.

Thanks,

Grant

--------------

[blacksan · Accepted solution]

Palo Alto Web site  >  Support  >  Threat Database
drop down and select Virus.

I was just there looking for the same thing.

[grant_sturgis]

Thanks, it looks to me like it's not recognized.

Any thoughts on mitigation?

[kbaldwin]

It might be listed under a different name. Trend Micro recognizes it as WORM_MEYLME.B.

[twilson]

I don't see anything on any virus. You would think you could just select from the drop down and hit enter and it would pull up a list, but I get nothing, even when I put something in there still nothing.

[grant_sturgis]

unfortunately, no.

[grant_sturgis]

if you're not seeing anything, you're doing it wrong.

type w32 , change type to virus, hit find, and see an enormous list.

[bpappas]

This was slated to be included in last night's emergency Threat/AV content release for PAN OS 3.1.x.

PAN OS 3.0.x will be addressed with next Tuesday's content release.

[KatanaNZ]

I still dont see this added into the threat database...is it known by a different name in Palo Alto land?

[migration]

Hi,

Coverage for "Here you have" virus is as follows:

3.1

Virus Name: Trojan/Win32.swisyn.bofj

Content release: 271 (daily content release)

Release date: 5th August

Virus Name: Trojan/W32.swisyn.bxoh

Content Release: 299-364 (Daily A/V content update)

Release Date: 10th Sep

3.0

Virus Name: Trojan/Win32.swisyn.0804

Content release: 203 (weekly content release)

Release date: 25th August

Thanks,

Sandeep