Several new variants emerged overnight http://www.f-secure.com/v-descs/_new.shtml
--> 2004.12.30 Cabir.K
--> 2004.12.30 Cabir.L
--> 2004.12.30 Cabir.J
--> 2004.12.30 Cabir.G
--> 2004.12.30 Cabir.F
--> 2004.12.28 Cabir.I
--> 2004.12.27 Cabir.H
Cabir source code published http://www.viruslist.com/en/weblog
Over the last few days we see several versions of Cabir. They are not very different from each other, just in unimportant ways. Today we found out that the source code that these different versions were compiled from was published on the Internet. This means it can be accessed by anyone.
As far as we know, until now the Cabir source code was accessible only to a limited number of people, including members of the international virus writing group 29A. It was a 29A member who wrote the original version of Cabir. We think it was planned to publish the source code in the next edition of the group's electronic journal.
However, it looks that someone has already got access to the code, and now it's public. This will lead to a lot of new versions of Cabir, which has already been detected in the wild in 7 countries.