Slashdot Mirror

!seineew era sreenigne enohPi

Mods: Poster is referring to "Netscape engineers are weenies!", found (typed backwards!) as the password to a vulnerable version of DVWSSR.DLL for Frontpage 98. Really.

Your hypothesis reminds me of the "Frankie" virus that targeted pirated versions of Aladin (a Mac emulator for Atari ST). It ended up attacking most Mac emulators on the ST, and not just the ones it was supposed to target (although some, like SPECTRE, were naturally immune).

In 2004 a crack hacker tools .DEB was sent to McAfee Virus Detention Lab under the supervision of the "Master Control Warden". These programs promptly escaped from maximum security firewalls to the Palo Alto underground. Today, still wanted by the RIAA, they survive as SOFtware as a service. If you have a DVD or a Blu-Ray no one else can decode, and if you can find|grep them, maybe you can hire... The 0x41 Team

McAfee Stinger

http://vil.nai.com/vil/stinger/

Try McAfee's Stinger. http://vil.nai.com/vil/stinger/ Although it is limited, it is stand alone and another tool in your arsenal to remove the nasties. I haven't used it in a while, so YMMV.

Only problem being, by that definition, Windows nowdays doesn't have viruses either. They just have spyware, adware, and trojans.

Oh really? You mean these aren't viruses?

• W32/Expiro.e
• W32/Winemmem
• W32/Sality.gen

These all fit the definition of a virus and there are tons more in the McAfee Threat Center.

Only problem being, by that definition, Windows nowdays doesn't have viruses either. They just have spyware, adware, and trojans.

Oh really? You mean these aren't viruses?

• W32/Expiro.e
• W32/Winemmem
• W32/Sality.gen

These all fit the definition of a virus and there are tons more in the McAfee Threat Center.

Only problem being, by that definition, Windows nowdays doesn't have viruses either. They just have spyware, adware, and trojans.

Oh really? You mean these aren't viruses?

• W32/Expiro.e
• W32/Winemmem
• W32/Sality.gen

These all fit the definition of a virus and there are tons more in the McAfee Threat Center.

It isn't instantaneous lol. Your system has to do a scan using the updated definitions before it quarantines the system file and hoses your computer. So you could very well have downloaded the update, but it's a ticking time bomb, waiting for your next manual scan or auto scan to hose it.

If by some chance you haven't been hosed yet, and can still read this, see http://vil.nai.com/vil/5958_false.htm on what you need to do to avoid the problem.

If your running Windows you might try a program called Format Factory its free and it is amazing in that it can convert almost any format with very little loss in quality.

FYI, Format Factory 2.2 (the newest version, released in December) appears to have the Generic.dx!kdh trojan, according to McAfee. This is a recently reported trojan, and is only discovered with DAT files less than 12 days old. I downloaded Format Factory 2.2 from 3 different sites and while the zip file names were slightly different, all three were reported as having an exe file infected with Generic.dx!kdh.
http://vil.nai.com/vil/content/v_252791.htm
There is not much information on this trojan right now, but it appears to be a member of a family which disable protective software and install IRC back doors for DDOS attacks or for later installation of other malware.
http://vil.nai.com/vil/content/v_141693.htm
Maybe it's a false positive. And maybe the developer's machine is spreading something unpleasant.

If your running Windows you might try a program called Format Factory its free and it is amazing in that it can convert almost any format with very little loss in quality.

FYI, Format Factory 2.2 (the newest version, released in December) appears to have the Generic.dx!kdh trojan, according to McAfee. This is a recently reported trojan, and is only discovered with DAT files less than 12 days old. I downloaded Format Factory 2.2 from 3 different sites and while the zip file names were slightly different, all three were reported as having an exe file infected with Generic.dx!kdh.
http://vil.nai.com/vil/content/v_252791.htm
There is not much information on this trojan right now, but it appears to be a member of a family which disable protective software and install IRC back doors for DDOS attacks or for later installation of other malware.
http://vil.nai.com/vil/content/v_141693.htm
Maybe it's a false positive. And maybe the developer's machine is spreading something unpleasant.

"Cutwail, Mega-D, Rustock and handful of other botnets already have control of upwards of five million compromised computers .. Cutwail also distributed the Bredolab Trojan dropper, disguised in the form of a .ZIP file attachment"

What Operating System did these 'compromised computers' run on ?

'Upon execution Bredolab attempts to inject into svchost.exe processes ..

Is this any better/worse than the Remote Code Execution vulnerability in Silverlight last month?

And a general question to Slashdot. Is the current proliferation and duplication of interactive web platforms (Flash, Silverlight, HTML5 etc) with the resultant increase in surface area for vulnerabilities better or worse than a monoculture?

Would we all be better off just pushing for a single web platform?

Oh, so they are the ones behind the Skynet virus!

McAfee Stinger for Conficker located at: http://vil.nai.com/vil/averttools.aspx

Worms still need to get executed. Not all execution requires user interaction.

Of course a computer running (as TSR) the STONED virus will infect any disk placed in it. But that is not the question. The question is whether a diskette with the STONED virus on it can infect a clean machine without executing or booting from the diskette. This is impossible (see the part that says "only way to infect a computer with an MBR/Boot Sector infector is to attempt to boot from an infected floppy diskette", STONED is a MBR infector).

Two words, Twitter:

Surface. Area.

Four more words:

Ramen. And. Slapper. Worms.

Four final words:

Your. Shit. Stinks. Too.

Two words, Twitter:

Surface. Area.

Four more words:

Ramen. And. Slapper. Worms.

Four final words:

Your. Shit. Stinks. Too.

• 
  Frozen Heads Software for the Macs http://frozenheads.com/
  polar software for the helpdesk http://www.polarsoftware.com/
  
  And of course Penguin everything
  
  but the burning question: Does he type everything using the CAP lock ?

yeah we all know about Ask.com's privacy initatives

http://www.benedelman.org/spyware/ask-toolbars/
http://blogs.zdnet.com/Spyware/?p=858
http://www.benedelman.org/news/050205-1.html
http://vil.nai.com/vil/content/v_131461.htm
http://research.sunbelt-software.com/threatdisplay.aspx?threatid=14137
http://www.siteadvisor.com/sites/ask.com

and their seedy domains that target children

cursormania.com
funbuddyicons.com
funwebproducts.com
historyswatter.com
myfuncards.com
mymailnotifier.com
mymailstationery.com
mymailsignature.com
mymailstamp.com
mywebsearch.com
popswatter.com
popularscreensavers.com
smileycentral.com
zwinky.com

ask.com are nothing but lying, deceptive scumbags, they deserve every lawsuit and fine they get

http://vil.nai.com/vil/Content/v_99992.htm

OK, this was 4 years ago, but what guarantees it won't happen again? Granted, SSH and friends also have had/will have their own bunch of problems. But that's beside the point, all software will. However, I'd like to ask, in which would you trust more, on a DB for implementing encryption or on an SSH server?

Given, I think TFA goes a little bit too far on the sensationalism, but I doubt all those servers are properly configured with encrypted connections, and god knows what else might be open besides the DB server.

Bottom line: it's not the end of the world, but it's not good news either.

The Nachi worm was written to search out computers infected with the now-famous Blaster worm and patch the computer with a Microsoft patch. It replicated itself around the world, and once the patch had been implemented and the Blaster worm deleted it deleted itself. Unfortunately it created a heck of a lot of traffic on infected networks, which slowed them down considerably.

Let's see which browser passed the ACID2 test first, shall we?

Or, do you mean "do things" like totally pwn your Windows box with some wayward ActiveX component (note that that was patched, but was only a few months ago, in February)?

I guess I'll just have to be content with my plain ol' Standards Compliant browser, then.

Pity me. Mwuhahahahahahaaaaaa!

You're breaking the social contract, you bastard!

So, would it be wrong to show people the whole list, allowing many people to ignore their ad-laden web page altogether?

Fasterfox
NoScript
Adblock Plus
PDF Download
VideoDownloader
Greasemonkey
ScribeFire
TrackMeNot
Tabbrowser Preferences
Tabbrowser Extensions
FormSpy

Hmmm. It doesn't feel wrong.

http://vil.nai.com/vil/content/v_130620.htm

connectionless packet services?

Or have we forgotten about SQL Slammer, which used a UDP vector?

Unless, with appropriate hand-waving, we are no longer talking about connections patterns and switching the discussion to packet-destination patterns. Which opens up other UDP-based legitimate applications to pre-emptive blockage. Imagine your lag rage when your antivirus whacks your MMO session.

I agree with you, although... I have to wonder, how did it get on the iPod in the first place? If you look at the W32/Rjump worm you can see that it spreads itself by copying itself to mounted removeable storage drives.

Perhaps someone tested a prototype on an infected windows machine, to make sure some minor manufacturing change didn't bork the device. Then after working on it a bit they got it to work, copied the image over, and all of a sudden you have iPods being pumped out of the factor with a virus on them. Clearly just a guess, but if something similar to that happened and I was Apple I'd sure as hell be pissed that Windows lack of security caused my hardware devices to get factory shipped with a virus on them.

Note that this scenario is supported by TFA: "Joswiak said it was traced to a particular Windows machine in the manufacturing lines of a contract manufacturer that builds the iPods for Apple."

In that context, Apple has every right to be irritated. Either way though you're right, it's a pretty stupid PR move to make a comment like that. They should just apologize, fix the problem, and move on.

The article is not clear. If not, get it off the Moz site. If so, sux to be them.

It is: "presenting itself as a legitimate existing extension called numberedlinks".

The McAfee characteristics page (2nd tab - stupid that that isn't directly linkable) also says:

The original component installs the following files:
* %MozillaUserProfile%\(ARBITRARY_CLASS_ID)\chrome\n umberedlinks.jar

FormSpy installs these additional files:
* %MozillaUserProfile%\(ARBITRARY_CLASS_ID)\chrome\n umberedlinks.jar (modified - FormSpy)

"Linux/Exploit-PRCTL exploits a behavoral flaw in core dump handling in specific Linux 2.6 kernels with suid_dumpable support (CVE-2006-2451). When successfully run, the non-privileged user can attain root user privileges on a Linux machine. This malware may be used in conjuction with other exploits to penetrate Linux servers remotely."

..... who said that that OSX is the next Windows:

http://download.nai.com/products/mcafee-avert/Whit ePapers/NewAppleofMalwaresEye.pdf

So take anything they say with a grain of salt.

Only on January 5th. Happy birthday Joshi.

http://vil.nai.com/vil/content/v_1169.htm

Stoned

Type
        Virus
SubType
        Boot
Discovery Date
        02/01/1988

I do, primarly because I am a gamer. When I can play Oblivion, Half-life 2, Call of Duty 2 and all my games under Linux, I will switch to linux fulltime. Until then, I will continue to use Windows XP Pro. There are some real world uses for Windows that Linux still cannot provide. Gaming is one of them. Even Mac has some of the major game titles, but not even close to 50% of the games that are available to Windows users. There is no ultimate OS, each has it's own benefits and drawbacks. If you're a gamer, you're stuck with Windows, if you run a server, you probably use linux. It's about using the right tool for the right job. I first tried slackware back in `95 and I loved it, I would love to be able to use linux for gaming, but that won't be happening anytime soon (if ever). Mainly because the majority of people own Windows computers, so the majority of game developers will make their product for that platform, as it has the biggest user base.

I don't even have a virus scanner installed on this computer, this is my gaming pc and I keep it clean of any and all software not including games. As long as you aren't downloading some unknown crap off the internet you shouldn't need antivirus software. I haven't gotten a virus in more then 7 years and I have used antivirus software in the past, mainly Mcafee and Norton. Once in a while I will use Mcafee's Avert Stinger to do a quick scan for the latest virus/worms. It's free and you don't have to install it or any bloated software, just download and run it from the download directory. I believe Symantec and a few other companies also provide some useful free virus removal tools that don't need to be installed to run.

First off, read the original McAfee Report before you bash them as FUD spreading capitalists.

Why that wasn't included in the posted story, I'll never know. If you actually take a look at the PDF, it's got some good histograms and charts as well as a little more detail into the Leap virus.

Yes, it does follow from this that users should buy McAfee anti-virus for Macs. The simple fact of the matter is that this is a white paper that tilts in their favor. It has some valid points, though, and I don't think they need to tell people to be afraid. If Mac users start getting these viruses then they will truly need anti-virus software for their machines. They site the National Vulnerability Database and other sources in this document so it's not like they're making stuff up or are the only ones claiming there is an upcoming security risk.

I hate McAfee software. Like most anti-virus software, it uses too much memory and hogs the CPU if it's a real-time checker. I wouldn't opt for it if it was the last anti-virus company in existence. However after reading their white paper, it is convincing. I do think that if Apple doesn't take an initiative to protect their users from things like Leap then Mac users will need auxiliary anti-virus protection from a third party.

One man's FUD is another man's common sense. I don't care about the size or manufacturer of a device--if it runs programs in a turing-machine like manner, it can be infected.

McAfee's complete list of files includes FrameworkService.exe... which is part of the McAfee suite (Enterprise Policy Orchestrator, I believe). I guess they got one thing right when they started detecting their own software as infected!

Thank God I can now rest easy!

Just noticed the screenshot on the McAfee page for W95/CTX. It shows some dlls from the Ethereal program as being infected. Of course those files are in their complete list of affected files, which comes in a convenient easily accesible PDF file as all the most important documents on the web should. It's 7 pages long, but an amusing list to skim through.

Who uses Ethereal and McAfee? Just found that funny/ironic on some levels.

Just noticed the screenshot on the McAfee page for W95/CTX. It shows some dlls from the Ethereal program as being infected. Of course those files are in their complete list of affected files, which comes in a convenient easily accesible PDF file as all the most important documents on the web should. It's 7 pages long, but an amusing list to skim through.

Who uses Ethereal and McAfee? Just found that funny/ironic on some levels.

This is the second time in a month, although much worse than the last one. On the 23rd Feb, my mum asked me about an issue where McAfee had just cleaned Firefox of a trojan: Exploit-MS06-006.gen. Turns out that it was a false-positive and it had needlessly truncated some files.

Corporate User : Low
Home User : Low

Whitehat viruses do exist in the wild. However, they too can bring down networks in a DDoS style; even while cleansing the system.

Computer virus infects Air Canada check-in system
W32/Nachi.worm

We have a penalty for blatant ignorance. This results in a two year internet privilege suspension and an additional beating around the ears with an Internet for Total Fucking Dummies book. PLease step away from the keyboard and assume the position!

Symantec Antivirus Center
Computer Associates Virus Information Center"
McAfee Virus Library
Kaspersky Virus Encyclopedia
Panda Software Virus Encyclopedia
Sophos virus analyses
BitDefender Virus Encyclopedia

For those that will argue that these search engines do not behave as the article requested; it is simply a matter of searching for the right symptoms. If you accurately describe the behavior of the virus, all of these search engines give you the answer.

The fact of the matter is that the very best solution is simply to use a commercial antivirus solution. If you are infected with a 0hour virus, simply wait an hour and run the update utility. Such a product will at least see the virus and tell you its name, even if it is unable to clean it. Worst case you have to use a bootable CD-ROM OS to catch/clean it.

Unless I misunderstood the question, besides the ones already pointed by some other folks, there's also http://vil.nai.com/vil/default.asp It even has a section dedicated to hoaxes, which I regularly use to educate my friends and family about those "Microsoft warned about this virus yesterday, anti-virus vendors don't know about it yet, pass this to all your contacts" e-mails.

Not very long ago, when the Kama Sutra (Nyxem.E, MyWife, whatever) worm was released to the world it seemed to take absolutely forever to find anyone with a solution for the removal or even the detection of the thing.

• Kaspersky (I think) - which seems to use GMT for their times,
  
• Symantec - I don't know what timezone they use.

Actually, you're wrong there. This is PRECISELY the sort of thing that up to date antivirus software prevents every day in the Windows universe. Welcome to the world.

As has been already pointed out (and seeminly ignored) the vast majority of recent Win32 malware has been in the form of just this sort of self replicating trojan horse. One clever bit of Win32 malware even packs itself into a password protected ZIP (to evade gateway antivirus scanners) and mails itself (inside the ZIP) along with instructions asking the receiver to unpack with the supplied password.

And it spreads.

Here is the assessment of this worm: http://vil.nai.com/vil/content/v_138578.htm

And here is the ecrypted ZIP worm: http://vil.nai.com/vil/content/v_126792.htm

Actually, you're wrong there. This is PRECISELY the sort of thing that up to date antivirus software prevents every day in the Windows universe. Welcome to the world.

As has been already pointed out (and seeminly ignored) the vast majority of recent Win32 malware has been in the form of just this sort of self replicating trojan horse. One clever bit of Win32 malware even packs itself into a password protected ZIP (to evade gateway antivirus scanners) and mails itself (inside the ZIP) along with instructions asking the receiver to unpack with the supplied password.

And it spreads.

Here is the assessment of this worm: http://vil.nai.com/vil/content/v_138578.htm

And here is the ecrypted ZIP worm: http://vil.nai.com/vil/content/v_126792.htm

"As much as I appreciate the warning, hints on HOW to know if you're infected would have certainly helped."

As much as I appreciate your comment, hints on HOW to know if you're infected would have certainly helped.

So I don't get the same response to this comment, here's some links to Nyxem/Karma Sutra/MyWife (Whatever you wanna call it) removal:

- Symantec
- McAffee

Haydn.

From McAfee site it has beening covered since 02-12-05? (Minimum DAT: 4642 (12/02/2005) People should be updated by now....

AdAware, SpyBot and MS Antispyware will see many malware programs, but will be unable to remove certain programs. (Virtumondo is one such nasty, as it can bind itself to the winlogon.exe or other critical processes, and the antispyware programs were unable to extract it.

Hijack this will at least let you view the details of your system, and let you remove the malware by hand.

Yakee Doodle