Trilight Zone

[tricore]

Security Experts warned administrators on Monday that a bot program has started to spread by exploiting five patched Microsoft vulnerabilities and a six-month-old flaw in Symantec's antivirus software.

The bot program, identified as W32.Spybot.ACYR by Symantec, has compromised a small number of systems at various universities, including about 30 systems at the University of Arkansas and another 150 systems at the University of New South Wales in Australia. The spread of the bot software became noticed because of an inordinate amount of traffic to the network port number used by Symantec's software--both the Internet Storm Center and the Research and Education Networking Information Sharing and Analysis Center (REN-ISAC) reported spikes in traffic to port 2967.

While network data from the ISC and the REN-ISAC suggests that more than a thousand systems may have been compromised, an accurate tally was not immediately available.

"Our priority thus far has been to facilitate sharing protection and response information amongst our members," Douglas Pearson, technical director for the REN-ISAC, said in an e-mail interview. "We've not yet developed an assessment of status and possible impact."