<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2//EN">
<HTML>
<HEAD>
<META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=us-ascii">
<META NAME="Generator" CONTENT="MS Exchange Server version 5.5.2653.12">
<TITLE>Possible New Malware</TITLE>
</HEAD>
<BODY>
<P><FONT SIZE=2 FACE="Arial">Anyone Heard of</FONT> <FONT SIZE=2 FACE="Courier New">BackDoor-CIW?</FONT>
</P>
<P><FONT SIZE=2 FACE="Courier New">This is a piece of malware with the .exe of winstr32.exe that is causing 99% CPU on a couple machine at a remote location. I found that one infected machine does not have MS04-11 patched. So that could be an attack vector.</FONT></P>
<P><FONT SIZE=2 FACE="Courier New">I get no luck googling for the .exe or BackDoor-CIW <---- This is what Postini identifies the file as.</FONT>
</P>
<P><FONT SIZE=2 FACE="Courier New">I'm trying to get a copy to put in my VMWare Lab.</FONT>
</P>
<BR>
<P><FONT SIZE=2 FACE="Arial">Also---- Isn't there a website that we can email this file to and it will run several AV solutions on it to find more info?</FONT></P>
<BR>
<P><B><I><FONT SIZE=4 FACE="Times New Roman">Joshua Perrymon</FONT></I></B><I></I>
<BR><B><FONT SIZE=2 FACE="Arial">Sr. Network Security Consultant</FONT></B>
</P>
<P><FONT SIZE=2 FACE="Arial">PGP Fingerprint</FONT>
<BR><FONT SIZE=2 FACE="Arial">51B8 01AC E58B 9BFE D57D 8EF6 C0B2 DECF EC20 6021</FONT>
</P>
<P><FONT SIZE=2 FACE="Courier New">**********CONFIDENTIALITY NOTICE**********</FONT>
<BR><FONT SIZE=2 FACE="Courier New">The information contained in this e-mail may be proprietary and/or </FONT>
<BR><FONT SIZE=2 FACE="Courier New">privileged and is intended for the sole use of the individual or </FONT>
<BR><FONT SIZE=2 FACE="Courier New">organization named above. If you are not the intended recipient or an </FONT>
<BR><FONT SIZE=2 FACE="Courier New">authorized representative of the intended recipient, any review, copying</FONT>
<BR><FONT SIZE=2 FACE="Courier New">or distribution of this e-mail and its attachments, if any, is prohibited.</FONT>
<BR><FONT SIZE=2 FACE="Courier New">If you have received this e-mail in error, please notify the sender</FONT>
<BR><FONT SIZE=2 FACE="Courier New">immediately by return e-mail and delete this message from your system.</FONT>
</P>
<BR>
<BR>
<BR>
</BODY>
</HTML>