IMBIG Virus Report

We have received an alert about a new virus, identified as IMBig.Trojan, that installs a backdoor on computers running Microsoft Windows operating systems. If you use Microsoft Internet Explorer Web browser (versions 5.01, 5.5, 6.0) and click on a malicious Web link on a compromised Web server, a program (iexpl.chm) is downloaded and installed on your computer. This trojan program captures and forwards information BEFORE it is sent over an SSL Web connection to specific banking Web sites. Thus, sensitive personal financial information is at risk of being forwarded to an unauthorized party.

The alert indicates that, as of June 30, 9am PDT, there are no anti-virus updates that will identify and remove this virus program. A security patch for Internet Explorer is also unavailable. The trojan program is active; however, the reported Web site that was reportedly seeking the personal information is currently disabled. The Trojan program may be watching for Web browser connections to:
commbank.com.au
citibank.com
stgeorge.com.au
bendigobank.com.au
anz.com
national.com.au
westpac.com.au
hsbc.com.au
barclays.co.uk
lloydstsb.co.uk
citibank.com.au
online-banking.standardchartered.com.hk
www.ebank.iba.com.hk
www.dahsing.com
www.citibank.com.hk
hsbc.com.hk
deutsche-bank.de
citibank.de
sparkasse-banking.de
banking.lbbw.de
dit-online.de
dab-bank.com
www1.bmo.com
www.scotiaonline.scotiabank.com
cibconline.cibc.com
www1.royalbank.com
easyweb.tdcanadatrust.com
suncorpmetway.com.au
cd.citibank.co.ae
ebank.uae.hsbc.com
banknetpower.net
nbd.ae
online-banking.standardchartered.ae
standardchartered.com
www.cbdonline.ae
www.arabi-online.com
banking.mashreqbank.com
www.unb.com
online.nbad.com
pbg1.edc.citiaccess.com
www.privatebank.citibank.com.sg
ekocbank.kocba nk.com.tr
internetsube.akbank.com.tr
hercules.pamukbank.com.tr
www.alahlionline.com
www.samba.com
www.almubasher.com.sa
www.sabbnet.com
e-gold.com

The presence of the following files on your computer may indicate an infection: sjdif.exe, iexpl.chm, img1big.gif. Please check for and install anti-virus program updates. You may need to make repeated program update checks with your anti-virus vendor.

Additional information: http://www.us-cert.gov/cas/techalerts/TA04-099A.html

IIS Web server patch information: http://www.microsoft.com/technet/security/bulletin/MS04-011.mspx