Signature Detail

WORM: Witty Infection Attempt

This signature detects the Witty worm attempting to infect a new host. Some ISS BlackIce ICQ decoder versions contain a vulnerability that Witty exploits to propagate from host to host. The worm corrupts local data, consumes network resources, and propagates itself.

Extended Description

The W32.Witty.Worm can cause data loss and system failure on an infected machine.

References

• URL: http://www.lurhq.com/witty.html
• URL: http://vil.nai.com/vil/content/v_101118.htm
• URL: http://securityresponse.symantec.com/avcenter/venc/data/w32.witty.worm.html
• URL: http://www.eeye.com/html/Research/Advisories/AD20040318.html