Slashdot Mirror

OK, so we have a bunch of ignorant users who either don't know or don't care about this problem. I've always wondered if there was a good use for an Internet chain letter, and I think I've finally found one. Just send the following message to your favorite ignorant user. Maybe if this spreads, people will be so afraid that they'll actually clean their systems. Or at least we'll get to watch them squirm.

Subj: WARNING!!! Get rid of viruses or go to jail!!!

Please read this message! It is extremely important! It might even keep you out of jail!!!

You've probably heard about all the computer viruses that have been spreading like wildfire in the past few years. What you probably haven't heard is what they've been doing to the computers they infect. They've been turning these computers into "zombie computers" that can be controlled over the Internet to send spam, to attack other computers and Web sites, and to spread "phishing scams" to trick people into turning over credit card and bank account information to criminals. These infected computers are grouped into "botnets" and rented out to do the dirty work of whoever is willing to pay, often spammers, extortionists, and other criminal gangs located here and overseas in places like Russia, China, and Eastern Europe. AND YOUR COMPUTER COULD BE A ZOMBIE WITHOUT YOU EVEN KNOWING IT! RIGHT NOW, EVEN AS YOU READ THIS, YOUR COMPUTER COULD BE CHURNING OUT SPAM OR PERFORMING MANY OTHER CRIMINAL ACTIVITIES!!!

This isn't just a minor problem. In fact, it's gotten so bad that THE FEDERAL GOVERNMENT WILL SOON START PROSECUTING PEOPLE WITH INFECTED COMPUTERS!

In a recent Senate committee hearing, Dept. of Homeland Security secretary Tom Ridge said, "The attacks these infected computers can launch has become a matter of national security. We've tried and tried to educate people to run antivirus software to keep their computers free of these viruses, but it appears they aren't listening. I hate the idea of having to start prosecuting ordinary Americans for this, but we don't have many options left."

Ridge went on to say that DHS wants to give people time to get these viruses off their computers, so they plan to wait until Tuesday, September 6, 2005 before they start filing charges.

So, you have until TUESDAY, SEPTEMBER 6, 2005 (the day after Labor Day) to clean your computer of viruses. Otherwise, YOU COULD BE PROSECUTED!!!

BUT DON'T PANIC! Cleaning your computer is easy, and you don't even have to shell out any money to do it. Several antivirus companies have stepped up to the plate to help people meet this important deadline by offering free antivirus software.

AVG Free Edition
http://free.grisoft.com/

avast!
http://www.avast.com/eng/down_home.html

AntiVir Personal Edition Classic
http://www.free-av.com/

Even Microsoft has put up a site with links to free antivirus software from several companies.

http://www.microsoft.com/athome/security/protect/w indows2000/antivirus.mspx

If you don't have time to download and install antivirus software right now, several antivirus companies have even put up sites to do a quick scan and clean any viruses they find. THEY DON'T REPLACE ANTIVIRUS SOFTWARE, but they will let you quickly clean your computer until you can get software installed.

Trend Micro
http://housecall.trendmicro.com/

Symantec
http://security.symantec.com/sscv6/default.asp?pro ductid=symhome&langid=ie&venid=sym

McAfee
http://us.mcafe

Phishing with Worms today!

3 New Mytob variants out today:
http://www.symantec.com/avcenter/index.html

They do this at my school, too. The worst part is that the public agrees with it! They are trying to 'protect their children' or something like that. http://enterprisesecurity.symantec.com/content/dis playpdf.cfm?pdfid=31&EID=0 for the article.

I would like to see a worm that goes around and patches servers for a change. It can be done.

Something like this?
http://securityresponse.symantec.com/avcenter/venc /data/w32.welchia.worm.html

I would like to see a worm that goes around and patches servers for a change. It can be done.

Welchia attempted to patch the DCOM RPC vulnerability that Blaster feed on and remove Blaster if present. It was called the "good samaritan worm". The problem was, as the AC pointed out, the network traffic Welchia generated DoSed any network that it "aided". Other "helpful" viruses have existed, but usually had the same unfriendly welcome for the same reason.

MSBlaster was actually a worm. It infected the system without the knowledge or assistance of an end user. The inherent vulnerability of the Windows platform to countless buffer overflow exploits enabled the massive large scale malware outbreaks that people think of by name - Code Red, MS Blaster, SQL Slammer, etc.

There exist however, countless email borne viruses, and for any one of them your point remains valid. A particularly clever email virus can trick an end user into clicking, "Yes", to the question, "Would you like your computer to be 0wn3d?" regardless of platform.

Been done before, but not with Seti : Symantec Writeup.

You may want to read this (search for gunbound) and ask your kids what else they installed.

"Security" is being treated by most vendors and companies as a pest-control business. "How many threats did we detect today?" "What are the top 10 threats this week?" "How fast can we get the virus definitions updated?" But those aren't the real threats. It's the quiet, narrowly targeted attacks that cost companies real money.

Military security people make that distinction. They're trained to view kids throwing rocks over the fence as a minor threat, while focusing on a phony cleaning guy sneaking in and getting a peek at the good stuff. Computer security people don't get this. Yet.

Look at, say, the Symantec web site. It's entirely oriented toward protecting against pest-type threats. And "pest removal". If there's a serious attack, by the time you get to "virus removal", the crucial information has long since been stolen.

This leads to many problems like stuff found recently in almost all Computer Associates eTrust Antivirus products. Because Zonealarm licenced the same software, they were affected, too.

This is just one example of many :

• McAfee
• Trend Micro
• F-Secure
• Symantec

So many well known enterprice Antivurs/Firewall companys create drivers that lead to security flaws and it is not limited to Windows....

I've got one Windows machine, running 2K Pro, and hiding somewhere on it is ISTsvc.exe. Pesky little bugger. Can't seem to get rid of it, but I can keep it contained with:
AdAware
Spybot Search and Destroy
SpywareBlaster
and
F-Prot Antivirus, which actually does a good job all by itself.
I tried the Symantec Istbar removal tool, but to no avail. I might try digging around in the registry again, but last time I did that it didn't work either.

Any suggestions, anyone?

(tig)

The worm known to Symantec as W32.Witty.Worm actually exploited a defect in commercial firewall products.

This worm caused quite a stir in the security consulting community as a result. Professionals for years were recommending PC firewall products as part of a defense in depth strategy. The risk with these modern fancy host based firewalls is that they let the packet on the box and inspect it before deciding what to do.

http://securityresponse.symantec.com/avcenter/venc /data/xm.compat.a.html

Payload

The payload is potentially troublesome. It is triggered on any day after August 31, 1998 when closing an infected spreadsheet. When triggered, it picks a worksheet but the active one and loops a thousand times to randomly select used cell that contains numeric value. With 1% chance, it decreases or increases the cell value within 5%.

Although this virus is not infectious in MS Excel 97 spreadsheet files, the payload routine is still called while closing an infected file.

Symantec Security Response lists this: Trojan.Pgpcoder They give the following details:


# Any files found which match this prerequesite are encoded and become unreadable.

# Ceates the file ATTENTION!!!.txt in every folder in which it encoded a file. The textfile contains the following:

Some files are coded.
To buy decoder mail: [user]@yahoo.com
with subject: PGPcoder 000000000032

# If the Trojan successfully completes its encoding routine on all files, it will delete itself through the creation of the file c:\tmp.bat. This .bat file will also delete itself.

So its not all BS.

http://securityresponse.symantec.com/avcenter/venc /data/trojan.pgpcoder.html

---

Websense alert

It is particularily interesting to note that this is a browser vulnerability exploit rather than an actual virus.

---

Symantec description of the Trojan Horse encoder

A google search for PGPcoder will turn up lots more.

Enjoy ..

http://service1.symantec.com/SUPPORT/tsgeninfo.nsf /docid/2001052409420406?OpenDocument&src=sec_doc_n am

http://service1.symantec.com/SUPPORT/tsgeninfo.nsf /docid/2001052409420406?OpenDocument&ExpandSection =2&Src=sec_doc_nam#_Section2

Enjoy ..

http://service1.symantec.com/SUPPORT/tsgeninfo.nsf /docid/2001052409420406?OpenDocument&src=sec_doc_n am

http://service1.symantec.com/SUPPORT/tsgeninfo.nsf /docid/2001052409420406?OpenDocument&ExpandSection =2&Src=sec_doc_nam#_Section2

actually, the screenshots in this powerpoint file show an advanced button - which is not present on the downloadable version. And, although the pdf has been deleted off of symantec's site, this link to google's cache gives details on creating simulation files - looks like it'd be cool to play with.

The comment above, however, makes no sense at all. That combined with it being mod'd up as 'funny' means it is likely a hoax.

Like Welchia?

I'm all for pushing technology forward, but integrating so many functions into one device can have a downside..

I don't think we're too far off from having spyware for mobile phones that sends advertising SMS messages to everyone in your phone address book. Or even calls everyone and plays a pre-recorded message. As these things become more ubiquitous, they'll be a larger and larger target.

ftp://ftp.symantec.com/misc/sabu/nis_beta_2005/NIS _ET.EXE 33.5 MB

I hate to tell you, but your "facts" are incorrect. Customer service is not in India.

http://www.symantec.com/corporate/

Take a look at the bottom of the page where customer service centers are located.

And yes, I DO work there.

ftp://ftp.symantec.com/misc/sabu/nis_beta_2005/NIS _ET.EXE

I see a lot of machines come in without Internet access and Symantec's firewall offering on the machine. Can't uninstall any of the Norton products, so have to remove them by hand.

That's strange. Of course you can uninstall any version of Norton products. If you couldn't, their corporate sales would take a big hit. Anyway, here is the link for 2004/5 and remember me every time that cash register goes 'cha ching'.

Ummm... they do offer a combined package (pc) (mac).

Ummm... they do offer a combined package (pc) (mac).

Be sure to run a few safe-mode virus scans as well with NAV/KAV/AVG/whatever you use :)

happy huntin'

Symantec Antivirus is available.

Now it's safe to get e-mail on W64.

It was first thought that blaster caused the 2003 blackout for the USA. While it played a role (delaying several major reporting systems that should have alerted plant officials in time to trigger failsafes) it never touched the direct controls of the plant. Slammer did penetrate deep into the Davis-Besse nuclear plant, but by luck the plant had a 6-by-5-inch hole in the plant's reactor head (Never thought I could say that about a hole in a nuke plant), so was already shutdown.

No, you can't.

SP2 only "breaks" versions of ZoneAlarm from 5.0.590 and back, while the latest version of ZoneAlarm, 5.5.062 works just fine in SP2.

As for WordPerfect, from MS' page containing broken programs:
Users may download WordPerfect Office 11 Service Pack 2 to correct this issue.

There's already a fix from Corel, so no problem there. Get the update, and continue using WordPerfect as you were.

As for Norton Anti-Virus, SP2 breaks NAV 2003, but Norton Anti-Virus 2005 is available as a prelacement/upgrade. If you're still not convinced on this, go here for more info on NAV.

Really, try to get a grip and do some objective investigation before going off on a wild rant.

SP2 only "breaks" versions of ZoneAlarm from 5.0.590 and back, while the latest version of ZoneAlarm, 5.5.062 works just fine in SP2.

As for WordPerfect, from MS' page containing broken programs:
Users may download WordPerfect Office 11 Service Pack 2 to correct this issue.

There's already a fix from Corel, so no problem there. Get the update, and continue using WordPerfect as you were.

As for Norton Anti-Virus, SP2 breaks NAV 2003, but Norton Anti-Virus 2005 is available as a prelacement/upgrade. If you're still not convinced on this, go here for more info on NAV.

Really, try to get a grip and do some objective investigation before going off on a wild rant.

No wonder estate agents and used car salesman have such an easy time

it's not only in the same state, its' only about 10 minutes from Novell in Utah County. There are actually a lot of Canopy group type companies in Utah county (not that Novell is anymore) there are a couple of stealth tech startups that will be interesting to watch (and many that are destined for failure). There are also a bunch of established technology companies that are hiring right now omniture or symantec
are probably the biggest. The only thing that sucks about living in Provo is the social atmosphere. People are downright strange there. They speak english, but it's like your in another country entirely. Novell's corporate culture is a good mix but after work you deal with neighbors, community. Think about the the portrail of the two brothers on Oceans 11 and the newer Oceans film from Provo. It was fairly accurate.

Blaster spreads peer to peer on unpatched machines.

I learned this the hard way last year, when I was doing a clean windows install on one of the machines we use at the help desk/ call center where I work. I had installed Windows and was in the process of dowloading SP1 (this was pre-SP2) and got a call from one of our security guys that one of the machines in our subnet was broadcasting Blaster traffic. Checked the IP address and it was the machine I had just set up.

I felt pretty stupid after that.

named Switchback which infected OSX Macs, but nobody noticed it.

There are others such as Renepo.B
MacOS MW2004 Trojan, MP3 Concept, Opener, and a sound driver virus.

I think clearly the only virus myth about OSX, is the myth that OSX has no viruses that can infect it. Apparently there are at least several examples of OSX viruses, and that number seems to grow. It may even double every year.

I've always felt that using a computer without virus protection was like having unprotected sex without a condom with multiple partners. Back in the old days, when they used to say that the Commodore Amiga had no viruses, and that only MS-DOS suffered from viruses, Amigas got their own viruses that infected their systems. Usually it was one of those Amiga demo programs that people downloaded from BBSes to show off the Amiga's graphics and sound. Someone would infect it with a virus and pass it around. Amiga users felt that the Amiga virus was a myth, and many got hit. Now I see the same thing happen for OSX, only OSX is on the Internet and is subject to more danagers than the BBS world once offered.

So yes, the facts speak for Symantec, that OSX viruses exist, and possibly they could grow in number.

This bone-headed stunt of offering a contest to virus infect two Macs only shows how gullable people are. It was a phoney contest.

named Switchback which infected OSX Macs, but nobody noticed it.

There are others such as Renepo.B
MacOS MW2004 Trojan, MP3 Concept, Opener, and a sound driver virus.

I think clearly the only virus myth about OSX, is the myth that OSX has no viruses that can infect it. Apparently there are at least several examples of OSX viruses, and that number seems to grow. It may even double every year.

I've always felt that using a computer without virus protection was like having unprotected sex without a condom with multiple partners. Back in the old days, when they used to say that the Commodore Amiga had no viruses, and that only MS-DOS suffered from viruses, Amigas got their own viruses that infected their systems. Usually it was one of those Amiga demo programs that people downloaded from BBSes to show off the Amiga's graphics and sound. Someone would infect it with a virus and pass it around. Amiga users felt that the Amiga virus was a myth, and many got hit. Now I see the same thing happen for OSX, only OSX is on the Internet and is subject to more danagers than the BBS world once offered.

So yes, the facts speak for Symantec, that OSX viruses exist, and possibly they could grow in number.

This bone-headed stunt of offering a contest to virus infect two Macs only shows how gullable people are. It was a phoney contest.

named Switchback which infected OSX Macs, but nobody noticed it.

There are others such as Renepo.B
MacOS MW2004 Trojan, MP3 Concept, Opener, and a sound driver virus.

I think clearly the only virus myth about OSX, is the myth that OSX has no viruses that can infect it. Apparently there are at least several examples of OSX viruses, and that number seems to grow. It may even double every year.

I've always felt that using a computer without virus protection was like having unprotected sex without a condom with multiple partners. Back in the old days, when they used to say that the Commodore Amiga had no viruses, and that only MS-DOS suffered from viruses, Amigas got their own viruses that infected their systems. Usually it was one of those Amiga demo programs that people downloaded from BBSes to show off the Amiga's graphics and sound. Someone would infect it with a virus and pass it around. Amiga users felt that the Amiga virus was a myth, and many got hit. Now I see the same thing happen for OSX, only OSX is on the Internet and is subject to more danagers than the BBS world once offered.

So yes, the facts speak for Symantec, that OSX viruses exist, and possibly they could grow in number.

This bone-headed stunt of offering a contest to virus infect two Macs only shows how gullable people are. It was a phoney contest.

I was under the impression that symantec updates their defs like once a week.

You have been mis-impressed.

I think you need to read this so that you understand how symantec updates work.

For people allergic to hyperlinks, Intelligent Update definitions are released daily, often multiple updates each day. Live update definitions are released weekly (every wednesday), unless a major threat is uncovered, in which case a new update is put out immediately.

The default (unmanaged) install of SAV will use live update for the weekly updates (and IIRC checks daily for a new download), but if you are running corp. edition, a clued up sys admin will probably have thrown together a wget script to pull down updates on a daily basis. Once this update is installed on the corporate AV server, the clients get the update almost instantly. I've seen a few AV systems, and this one is hard to beat.

Hear Hear!

cynical side notes:
There is no technical reason why I should not be able to walk into compusa, ask for a computer that by design doesn`t "get viruses" and not get laughed at. The orange book described what a secure computer system should look like, multics shows what a secure OS and computer system look like in reality... and they did so thirty f$%#ing years ago! (Also the morris worm was in 88) There is only one conclusion possible, everyone who can fix these problems once and for all has been abducted by aliens for twenty years now and noone noticed... or whatever. Their excuse better be good!

The fact that noone goes into compusa to ask for a computer that does not spend most of its time spreading worms and ddos might also be a small factor. This is ofcourse not going to change until the raporting on computer security moves on from spreading symantec FUD to doing real reviews of the stuff on the market. This would interfere with the megahurts/marchitecture "benchmarks" though...

To be fair this rapport isn`t all bad. It has the usual vaguely defined growing graphs, percentages only, no absolute numerbs and everything "Source: Symantec coorporation". You wont find those in honeynet and SANS data and analysis. Being ductape salesmen the symantecs of this world need their FUD...

However to the end the rapport has some real data from what looks like an impressive honeynet. You will have to go through the usual "number of rapported vulnerabilities" graphs comparing mozilla and internet explorer first though.

Since no one seems fit to actually read the report before commenting and looking like an idiot, here it is.

...that the number of bots is lower. Not exactly good for business. If you are going to rant, you might as well try to look half-intelligent by reading the report.

It explains how they obtained their data. It is through their DeepSight TMS and MSS services.

Yes, Symantec have a vested interest up the wazoo for that press release.

No kidding. It's not like they sell products for the Mac. They would stand in no way to benefit from alerting the community to this issue. They are doing it out of an altruistic sense of responsibility to the public.

</sarcasm>

It caused a lot of problems. Trust me. I worked at Best Buy. I had to clean up SO MANY [explicative]ing computers...

Welchia Worm did something similar too, it was a bear to get rid of. I'll cheer just as loud when one of these "white hat worm" authors get slocked up...

How many BIOS or Microcode expliots are out there?

BIOS exploit: Any boot sector virus, or the CIH virus that overwrites all data on your boot volume, including the BIOS Parameter Block in the first sector, and tries to erase your motherboard's flash BIOS. If that doesn't count, do you remember the F0 0F microcode bug on the Pentium?

See Net Nanny Also Norton Internet Security for your anti-virus and anti-spam. There are more products to "protect" your family. It should be a personal decision, not one for the government, at any level.

but does not appear to send personal information to a third party without notice

Symantec seems to think it does.

Before you call it funny, it happened in Belgium.
The belgian postal service set up a mailinglist which they used to warn people on new worms spreading.
Only staff members had the right to post, guess somebody messed up because the Lirva virus got spread by this list. (Translation of ZDnet article).