Bot spreads through antivirus, Windows flaws

University security experts warned administrators on Monday that a bot program has started to spread by exploiting five patched Microsoft vulnerabilities and a six-month-old flaw in Symantec's antivirus software.

The bot program, identified as W32.Spybot.ACYR by Symantec, has compromised a small number of systems at various universities, including about 30 systems at the University of Arkansas and another 150 systems at the University of New South Wales in Australia. The spread of the bot software became noticed because of an inordinate amount of traffic to the network port number used by Symantec's software--both the Internet Storm Center and the Research and Education Networking Information Sharing and Analysis Center (REN-ISAC) reported spikes in traffic to port 2967.

View : http://www.securityfocus.com/news/11426