said by kpatz :

---

I'm guessing the "random" destination port is calculated based on the destination IP. I'm making this assumption based on the fact that every single Witty hit I've seen on my IP has had the same destination port, 18067. Not exactly "random"...

---

said by KF_PM:

---

Goddamn this sucks. We have close to about 6000 laptop support users that work for our company that need reimaging due to the boot sector loss. And the tickets are in the thousands. I swear, the headaches are getting worse and worse listening to these managers go on and on, on their bridge calls. We're still having problems as of Sunday morning.

---

said by Link Logger :

---

This is very likely a 'thing' that someone or some group has against Black Ice or ISS, as again its purpose is ultimately to destroy the host on which it runs which isn't very common for worms and viruses as it is ultimately self defeating for itself (it lives long enough to infect other systems but ultimately it will kill itself). Witty's purpose is very much different then most worms and viruses that we see as it was made to destroy selected systems. I sure hope we are not entering a new phase of destructive worms and such as that would be very bad for all sorts of reasons beside the destroyed systems.

---

quote:

---

Witty Worm Remediation Information:

This information applies to customers currently using an impacted ISS product as detailed in X-Force Alert Article 167, which is referenced above. Consult this article for determining if a system is currently infected.

For systems that are NOT infected with the Witty worm:

- Update your ISS software to the latest version. The latest version of every ISS product is not impacted by the Witty worm.

For systems that are infected with the Witty worm:

- Power off the infected machine immemdiately.

- Since the worm overwrites random sectors of the hard drive as it executes within memory, customers should recover any available hard drive data using a noncompromised operating system.

- Customers should reload a working system image from backup using normal restore procedures. If reinstalling the ISS software is necessary, customers should update to the latest version.

Further questions should be directed to ISS Technical Support.

---

quote:

---

ISS network customers have been protected from this potential threat for more than a week prior to the release of the worm, removing any threat before impact. The fix was delivered as a maintenance update before eEye publicly disclosed the vulnerability. Before any worm could be developed 'in the wild', ISS customers were protected automatically via a simple update that shielded the vulnerability from attack.

---

said by justin :

---

But then, in the real world, a virus that kills the host is not a winning strategy. This is one that kills shortly after and hopefully after infecting a few more, like Ebola. Spectacular but short lived.

---

said by vic102482 :

---

How would this affect hardware firewalls:(

---

said by justin :

---

Perhaps the witty virus is authored by someone who does not have any financial interest direct or indirect in using infected machines. Or perhaps just a disgruntled employee of ISS.

---

said by atangel :

---

Can't destroy the PC you are on if you want to use it, but it also has contributed to the general apathy, I think, of most people. They hear about pop-ups (or get them and think it is part of the net) or they hear about a friend who got a virus, but no big deal, because there were no consequences really (they weren't inconvenienced).

---

said by jeisenberg :

---

In order to take part in myNetwatchman's service as a reporting node, I have had to set one of my PCs to run in the DMZ, then using a software firewall to catch and forward intrusion attempts. After seeing this "Witty" worm, I'm going to have to rethink that strategy.

I don't mind volunteering to fight against hacks and zombies, but I didn't bargain for being put in "real" harm's way.

---