Slashdot Mirror

why do reputable companies like Symantec, Amazon and others spam me?

http://securityresponse.symantec.com/avcenter/venc /data/w32.sobig.f@mm.html

it reads :
"Sobig.F obtains the UTC time through the NTP protocol, by contacting one of several possible servers on port 123/udp (the NTP port)."

I then would expect the following screnario : Very likely most netgear router users have used its nifty builtin dhcp server. cisco also has such embedded dhcp servers and does SMC barricade. So far nothing special. However if the embedded dhcp server of the netgear router also has dhcp option "option ntp-servers ip-address" configured, using the UWisc Time Server ip-number then the following most probably has happened :

W32.Sobig.F@mm is released on the Internet and hits hard. It spreads through email. upon storing itself on the NT4, win2k, winxp PC, it asks for UTC time through the NTP protocol. If the dhcp client has through dhcp already a configured ntp-server, that one (The UWisc one) will be used. If no ntp-server is configured only then the virus will try to reach the ntpservers listed on the symantec security response description for W32.Sobig.F@mm.

Robert

It would appear that few here have bothered to go look at Symantec's web site to see what they have to say about activation. Some of the things people have complained about, based solely on reading the Slashdot blurb, have no basis.

Interesting points are:

• You get 15 days after first install to activate
• You can activate over the phone
• You can transfer to an upgraded or new PC without repurchase

As a commercial software developer myself, I can understand why Symantec is doing this, though I too am amused at the "for your protection" approach that is so common. I also see activation is becoming more common (PowerQuest's new DriveImage 7 has it too), especially in products that people tend to buy once and install on multiple systems.

If formal and informal piracy wasn't so pandemic, such things would not be necessary. But it seems so many people believe that it's their RIGHT to steal software (or music), if they don't feel like paying for it. I know this is heresy for Slashdot, but there it is....

Loading arbItrary code from somewhere is a great way to leave flexibility in the system and also demonstrate destructive capability without actually having to resort to it. What does that have to do with spam?

The worm does definItely not create open relays - it can be used to create them through the backdoor it presents. The same backdoor can be used to run seti (hmm, there's a thought), delete files or any other annoying activity.

Yes, the payload download feature could be used for anything, including spam, but I find that hardly likely that a spammer is behind this for the reasons listed in the grandparent.

Occam's Razor is telling me that this article and the ones referenced by it are most likely unintentional FUD written by people that benefit from it (symantec et al sell anti-virus protection, while journalists sell papers, magazines or page impressions). While I wouldn't put it past Symantec and peers to intentionally spread FUD, I don't see journalists doing anything other than repeating what Symantec is publicising. Don't ascribe to malice what you can explain with incompetence. :-)

Occam's Razor also indicates that you'll have better chances in life if you brush up on your spelling. :-)

According to the Symantec write-up, the worm had at least one more trick up its sleeve with regard to the 20 hosts. It seems that if an infected machine receives a properly signed packet on UDP ports 995-999, it'll update the list of 20 hosts.

Of course the trick is finding a way to get that update out to all the infected machines. But really, all the virus writer has to do is update one machine (say by spamming a few IP ranges with likely victims *cough*homeDSLusers*cough*). The updated IP list will point to hosts that refer the infected machine to download an executable that cause the infected machine to start spamming out the master list update to random IP addresses. After that, the update should spread similar to a typical non-email network worm.

Then why does Symantec offer a program to remove the virus from a computer, for free?

If anyone is intersted, here's a "release history" :-P

SoBig.A

- Copies itself over network shares to shared start up folders on other computers.
- Sends a message to an address on pagers.icq.com.
- Uses a separate thread to download contents from a specific web site to %windir%\dwn.dat, and later executing it. (later reported to be "Backdoor.Lala")
- Looks for e-mail addresses to send mails to in the files with these extensions txt, eml, html, htm, dbx, wab.
- Stores sent messages in the file %Windir%\Sntmls.dat.
- Uses 4 random subject lines.
- Uses 4 random attachemenet names.
- Always uses big@boss.com in the "From" field in the mails sent.
- Size: 65,536 bytes

SoBig.B

Changes from SoBig.A:

- Always uses support@microsoft.com in the "From" field in the mails sent.
- Uses 9 random subject lines.
- Uses 9 random attachemenet names.
- Uses a deactivation date.
- Attempts to download data from four different GeoCities Web pages. The addresses of these Web pages are stored in various .ini files.
- Size: 52,898 bytes

SoBig.C

Changes from SoBig.B:

- Always uses bill@microsoft.com in the "From" field in the mails sent.
- Uses 7 random subject lines.
- Uses 8 random attachemenet names.
- Size: ~ 59 KB

SoBig.D

Changes from SoBig.C:

- Very few infections noticed (0-49 listed at Symantec). Changes unknown due to low infection rate.

SoBig.E

Changes from SoBig.D:

- Always uses support@yahoo.com in the "From" field in the mails sent.
- Uses 18 random subject lines.
- Uses 5 random attachemenet names.
- Size: 82,195 bytes (zip file), 86,528 bytes (executable)
- Sobig.E can download arbitrary files to infected computers and execute them. The author of the worm has used this functionality to steal confidential system information and to set up spam relay servers on infected computers. This functionality may also be used as a worm self-update feature. Under the correct conditions, Sobig.E attempts to contact one of the list of master servers, which the author of the worm controls. Then, the worm retrieves a URL that it uses to determine where to get the Trojan file, downloads the Trojan file to the local computer, and then executes it. The day of the week must be Monday or Friday. The time of the day must be between 19:00:00 UTC and 23:59:59 UTC. Sobig.E obtains the UTC time through the NTP protocol, by contacting one of several possible servers on port 123/udp (the NTP port). The worm starts the download attempt by sending a probe to port 8998/udp of the master server. Then, the server replies with a URL, where the worm can download the file to execute.
- Sobig.E opens the following ports: 995/udp, 996/udp, 997/udp, 998/udp, 999/udp, and it listens for any incoming UDP datagrams on these ports. Incoming datagrams are parsed, and upon receiving a datagram with the proper signature, the master server list of the worm may be updated.

SoBig.F

Changes from SoBig.E:

- Size: about 72,000 bytes
- Spoofed address (which means that the sender in the "From" field is most likely not the real sender). The worm may also use the address admin@internet.com as the sender.
- The spoofed addresses and the Send To addresses are both taken from the files found on the computer. Also, the worm may use the settings of the infected computer's settings to check for an SMTP server

If anyone is intersted, here's a "release history" :-P

SoBig.A

- Copies itself over network shares to shared start up folders on other computers.
- Sends a message to an address on pagers.icq.com.
- Uses a separate thread to download contents from a specific web site to %windir%\dwn.dat, and later executing it. (later reported to be "Backdoor.Lala")
- Looks for e-mail addresses to send mails to in the files with these extensions txt, eml, html, htm, dbx, wab.
- Stores sent messages in the file %Windir%\Sntmls.dat.
- Uses 4 random subject lines.
- Uses 4 random attachemenet names.
- Always uses big@boss.com in the "From" field in the mails sent.
- Size: 65,536 bytes

SoBig.B

Changes from SoBig.A:

- Always uses support@microsoft.com in the "From" field in the mails sent.
- Uses 9 random subject lines.
- Uses 9 random attachemenet names.
- Uses a deactivation date.
- Attempts to download data from four different GeoCities Web pages. The addresses of these Web pages are stored in various .ini files.
- Size: 52,898 bytes

SoBig.C

Changes from SoBig.B:

- Always uses bill@microsoft.com in the "From" field in the mails sent.
- Uses 7 random subject lines.
- Uses 8 random attachemenet names.
- Size: ~ 59 KB

SoBig.D

Changes from SoBig.C:

- Very few infections noticed (0-49 listed at Symantec). Changes unknown due to low infection rate.

SoBig.E

Changes from SoBig.D:

- Always uses support@yahoo.com in the "From" field in the mails sent.
- Uses 18 random subject lines.
- Uses 5 random attachemenet names.
- Size: 82,195 bytes (zip file), 86,528 bytes (executable)
- Sobig.E can download arbitrary files to infected computers and execute them. The author of the worm has used this functionality to steal confidential system information and to set up spam relay servers on infected computers. This functionality may also be used as a worm self-update feature. Under the correct conditions, Sobig.E attempts to contact one of the list of master servers, which the author of the worm controls. Then, the worm retrieves a URL that it uses to determine where to get the Trojan file, downloads the Trojan file to the local computer, and then executes it. The day of the week must be Monday or Friday. The time of the day must be between 19:00:00 UTC and 23:59:59 UTC. Sobig.E obtains the UTC time through the NTP protocol, by contacting one of several possible servers on port 123/udp (the NTP port). The worm starts the download attempt by sending a probe to port 8998/udp of the master server. Then, the server replies with a URL, where the worm can download the file to execute.
- Sobig.E opens the following ports: 995/udp, 996/udp, 997/udp, 998/udp, 999/udp, and it listens for any incoming UDP datagrams on these ports. Incoming datagrams are parsed, and upon receiving a datagram with the proper signature, the master server list of the worm may be updated.

SoBig.F

Changes from SoBig.E:

- Size: about 72,000 bytes
- Spoofed address (which means that the sender in the "From" field is most likely not the real sender). The worm may also use the address admin@internet.com as the sender.
- The spoofed addresses and the Send To addresses are both taken from the files found on the computer. Also, the worm may use the settings of the infected computer's settings to check for an SMTP server

If anyone is intersted, here's a "release history" :-P

SoBig.A

- Copies itself over network shares to shared start up folders on other computers.
- Sends a message to an address on pagers.icq.com.
- Uses a separate thread to download contents from a specific web site to %windir%\dwn.dat, and later executing it. (later reported to be "Backdoor.Lala")
- Looks for e-mail addresses to send mails to in the files with these extensions txt, eml, html, htm, dbx, wab.
- Stores sent messages in the file %Windir%\Sntmls.dat.
- Uses 4 random subject lines.
- Uses 4 random attachemenet names.
- Always uses big@boss.com in the "From" field in the mails sent.
- Size: 65,536 bytes

SoBig.B

Changes from SoBig.A:

- Always uses support@microsoft.com in the "From" field in the mails sent.
- Uses 9 random subject lines.
- Uses 9 random attachemenet names.
- Uses a deactivation date.
- Attempts to download data from four different GeoCities Web pages. The addresses of these Web pages are stored in various .ini files.
- Size: 52,898 bytes

SoBig.C

Changes from SoBig.B:

- Always uses bill@microsoft.com in the "From" field in the mails sent.
- Uses 7 random subject lines.
- Uses 8 random attachemenet names.
- Size: ~ 59 KB

SoBig.D

Changes from SoBig.C:

- Very few infections noticed (0-49 listed at Symantec). Changes unknown due to low infection rate.

SoBig.E

Changes from SoBig.D:

- Always uses support@yahoo.com in the "From" field in the mails sent.
- Uses 18 random subject lines.
- Uses 5 random attachemenet names.
- Size: 82,195 bytes (zip file), 86,528 bytes (executable)
- Sobig.E can download arbitrary files to infected computers and execute them. The author of the worm has used this functionality to steal confidential system information and to set up spam relay servers on infected computers. This functionality may also be used as a worm self-update feature. Under the correct conditions, Sobig.E attempts to contact one of the list of master servers, which the author of the worm controls. Then, the worm retrieves a URL that it uses to determine where to get the Trojan file, downloads the Trojan file to the local computer, and then executes it. The day of the week must be Monday or Friday. The time of the day must be between 19:00:00 UTC and 23:59:59 UTC. Sobig.E obtains the UTC time through the NTP protocol, by contacting one of several possible servers on port 123/udp (the NTP port). The worm starts the download attempt by sending a probe to port 8998/udp of the master server. Then, the server replies with a URL, where the worm can download the file to execute.
- Sobig.E opens the following ports: 995/udp, 996/udp, 997/udp, 998/udp, 999/udp, and it listens for any incoming UDP datagrams on these ports. Incoming datagrams are parsed, and upon receiving a datagram with the proper signature, the master server list of the worm may be updated.

SoBig.F

Changes from SoBig.E:

- Size: about 72,000 bytes
- Spoofed address (which means that the sender in the "From" field is most likely not the real sender). The worm may also use the address admin@internet.com as the sender.
- The spoofed addresses and the Send To addresses are both taken from the files found on the computer. Also, the worm may use the settings of the infected computer's settings to check for an SMTP server

If anyone is intersted, here's a "release history" :-P

SoBig.A

- Copies itself over network shares to shared start up folders on other computers.
- Sends a message to an address on pagers.icq.com.
- Uses a separate thread to download contents from a specific web site to %windir%\dwn.dat, and later executing it. (later reported to be "Backdoor.Lala")
- Looks for e-mail addresses to send mails to in the files with these extensions txt, eml, html, htm, dbx, wab.
- Stores sent messages in the file %Windir%\Sntmls.dat.
- Uses 4 random subject lines.
- Uses 4 random attachemenet names.
- Always uses big@boss.com in the "From" field in the mails sent.
- Size: 65,536 bytes

SoBig.B

Changes from SoBig.A:

- Always uses support@microsoft.com in the "From" field in the mails sent.
- Uses 9 random subject lines.
- Uses 9 random attachemenet names.
- Uses a deactivation date.
- Attempts to download data from four different GeoCities Web pages. The addresses of these Web pages are stored in various .ini files.
- Size: 52,898 bytes

SoBig.C

Changes from SoBig.B:

- Always uses bill@microsoft.com in the "From" field in the mails sent.
- Uses 7 random subject lines.
- Uses 8 random attachemenet names.
- Size: ~ 59 KB

SoBig.D

Changes from SoBig.C:

- Very few infections noticed (0-49 listed at Symantec). Changes unknown due to low infection rate.

SoBig.E

Changes from SoBig.D:

- Always uses support@yahoo.com in the "From" field in the mails sent.
- Uses 18 random subject lines.
- Uses 5 random attachemenet names.
- Size: 82,195 bytes (zip file), 86,528 bytes (executable)
- Sobig.E can download arbitrary files to infected computers and execute them. The author of the worm has used this functionality to steal confidential system information and to set up spam relay servers on infected computers. This functionality may also be used as a worm self-update feature. Under the correct conditions, Sobig.E attempts to contact one of the list of master servers, which the author of the worm controls. Then, the worm retrieves a URL that it uses to determine where to get the Trojan file, downloads the Trojan file to the local computer, and then executes it. The day of the week must be Monday or Friday. The time of the day must be between 19:00:00 UTC and 23:59:59 UTC. Sobig.E obtains the UTC time through the NTP protocol, by contacting one of several possible servers on port 123/udp (the NTP port). The worm starts the download attempt by sending a probe to port 8998/udp of the master server. Then, the server replies with a URL, where the worm can download the file to execute.
- Sobig.E opens the following ports: 995/udp, 996/udp, 997/udp, 998/udp, 999/udp, and it listens for any incoming UDP datagrams on these ports. Incoming datagrams are parsed, and upon receiving a datagram with the proper signature, the master server list of the worm may be updated.

SoBig.F

Changes from SoBig.E:

- Size: about 72,000 bytes
- Spoofed address (which means that the sender in the "From" field is most likely not the real sender). The worm may also use the address admin@internet.com as the sender.
- The spoofed addresses and the Send To addresses are both taken from the files found on the computer. Also, the worm may use the settings of the infected computer's settings to check for an SMTP server

If anyone is intersted, here's a "release history" :-P

SoBig.A

- Copies itself over network shares to shared start up folders on other computers.
- Sends a message to an address on pagers.icq.com.
- Uses a separate thread to download contents from a specific web site to %windir%\dwn.dat, and later executing it. (later reported to be "Backdoor.Lala")
- Looks for e-mail addresses to send mails to in the files with these extensions txt, eml, html, htm, dbx, wab.
- Stores sent messages in the file %Windir%\Sntmls.dat.
- Uses 4 random subject lines.
- Uses 4 random attachemenet names.
- Always uses big@boss.com in the "From" field in the mails sent.
- Size: 65,536 bytes

SoBig.B

Changes from SoBig.A:

- Always uses support@microsoft.com in the "From" field in the mails sent.
- Uses 9 random subject lines.
- Uses 9 random attachemenet names.
- Uses a deactivation date.
- Attempts to download data from four different GeoCities Web pages. The addresses of these Web pages are stored in various .ini files.
- Size: 52,898 bytes

SoBig.C

Changes from SoBig.B:

- Always uses bill@microsoft.com in the "From" field in the mails sent.
- Uses 7 random subject lines.
- Uses 8 random attachemenet names.
- Size: ~ 59 KB

SoBig.D

Changes from SoBig.C:

- Very few infections noticed (0-49 listed at Symantec). Changes unknown due to low infection rate.

SoBig.E

Changes from SoBig.D:

- Always uses support@yahoo.com in the "From" field in the mails sent.
- Uses 18 random subject lines.
- Uses 5 random attachemenet names.
- Size: 82,195 bytes (zip file), 86,528 bytes (executable)
- Sobig.E can download arbitrary files to infected computers and execute them. The author of the worm has used this functionality to steal confidential system information and to set up spam relay servers on infected computers. This functionality may also be used as a worm self-update feature. Under the correct conditions, Sobig.E attempts to contact one of the list of master servers, which the author of the worm controls. Then, the worm retrieves a URL that it uses to determine where to get the Trojan file, downloads the Trojan file to the local computer, and then executes it. The day of the week must be Monday or Friday. The time of the day must be between 19:00:00 UTC and 23:59:59 UTC. Sobig.E obtains the UTC time through the NTP protocol, by contacting one of several possible servers on port 123/udp (the NTP port). The worm starts the download attempt by sending a probe to port 8998/udp of the master server. Then, the server replies with a URL, where the worm can download the file to execute.
- Sobig.E opens the following ports: 995/udp, 996/udp, 997/udp, 998/udp, 999/udp, and it listens for any incoming UDP datagrams on these ports. Incoming datagrams are parsed, and upon receiving a datagram with the proper signature, the master server list of the worm may be updated.

SoBig.F

Changes from SoBig.E:

- Size: about 72,000 bytes
- Spoofed address (which means that the sender in the "From" field is most likely not the real sender). The worm may also use the address admin@internet.com as the sender.
- The spoofed addresses and the Send To addresses are both taken from the files found on the computer. Also, the worm may use the settings of the infected computer's settings to check for an SMTP server

If anyone is intersted, here's a "release history" :-P

SoBig.A

- Copies itself over network shares to shared start up folders on other computers.
- Sends a message to an address on pagers.icq.com.
- Uses a separate thread to download contents from a specific web site to %windir%\dwn.dat, and later executing it. (later reported to be "Backdoor.Lala")
- Looks for e-mail addresses to send mails to in the files with these extensions txt, eml, html, htm, dbx, wab.
- Stores sent messages in the file %Windir%\Sntmls.dat.
- Uses 4 random subject lines.
- Uses 4 random attachemenet names.
- Always uses big@boss.com in the "From" field in the mails sent.
- Size: 65,536 bytes

SoBig.B

Changes from SoBig.A:

- Always uses support@microsoft.com in the "From" field in the mails sent.
- Uses 9 random subject lines.
- Uses 9 random attachemenet names.
- Uses a deactivation date.
- Attempts to download data from four different GeoCities Web pages. The addresses of these Web pages are stored in various .ini files.
- Size: 52,898 bytes

SoBig.C

Changes from SoBig.B:

- Always uses bill@microsoft.com in the "From" field in the mails sent.
- Uses 7 random subject lines.
- Uses 8 random attachemenet names.
- Size: ~ 59 KB

SoBig.D

Changes from SoBig.C:

- Very few infections noticed (0-49 listed at Symantec). Changes unknown due to low infection rate.

SoBig.E

Changes from SoBig.D:

- Always uses support@yahoo.com in the "From" field in the mails sent.
- Uses 18 random subject lines.
- Uses 5 random attachemenet names.
- Size: 82,195 bytes (zip file), 86,528 bytes (executable)
- Sobig.E can download arbitrary files to infected computers and execute them. The author of the worm has used this functionality to steal confidential system information and to set up spam relay servers on infected computers. This functionality may also be used as a worm self-update feature. Under the correct conditions, Sobig.E attempts to contact one of the list of master servers, which the author of the worm controls. Then, the worm retrieves a URL that it uses to determine where to get the Trojan file, downloads the Trojan file to the local computer, and then executes it. The day of the week must be Monday or Friday. The time of the day must be between 19:00:00 UTC and 23:59:59 UTC. Sobig.E obtains the UTC time through the NTP protocol, by contacting one of several possible servers on port 123/udp (the NTP port). The worm starts the download attempt by sending a probe to port 8998/udp of the master server. Then, the server replies with a URL, where the worm can download the file to execute.
- Sobig.E opens the following ports: 995/udp, 996/udp, 997/udp, 998/udp, 999/udp, and it listens for any incoming UDP datagrams on these ports. Incoming datagrams are parsed, and upon receiving a datagram with the proper signature, the master server list of the worm may be updated.

SoBig.F

Changes from SoBig.E:

- Size: about 72,000 bytes
- Spoofed address (which means that the sender in the "From" field is most likely not the real sender). The worm may also use the address admin@internet.com as the sender.
- The spoofed addresses and the Send To addresses are both taken from the files found on the computer. Also, the worm may use the settings of the infected computer's settings to check for an SMTP server

Look, you don't have to be a pretentious dick about it. Worms can hit any platform including your relatively secure operating systems. People in glass houses shouldn't throw stones, and frankly, major Linux distributions have more than their fair share of major security vulnerabilities. The only saving grace of Linux is that it's relatively obscure OS compared to other major operating systems like Windows or MacOS. I count 41 security vulnerabilities in Red Hat 9 alone since late March. Many of those could've been exploited by a worm or malicious trojan and spread if as many people used Linux as they do Windows.

So get off your high horse and realize that every one of those operating systems you're pointing out was affected by major security vulnerabilities in the last year. Even OpenBSD, that bastion of secure operating systems, had a MAJOR remote root exploit in the default install (OpenSSH). Nobody is immune to bad programming and just bad luck. Shit happens, that's why there are patches. The problem is lazy incompetent system administration and not patching systems when they become available.

*rant* And for Christ's sake people, SHUT OFF DAEMONS YOU DON'T USE! Does your Solaris box REALLY need to be running ANY of that shit in /etc/inetd.conf that comes enabled by default? The answer is NO. Solaris works just peachy with everything in inetd.conf disabled, RPC disabled, and practically every other daemon started in the init scripts disabled. I'm sick of coming upon workstations with all this shit turned on and trying to figure out why they're running it on a desktop. */rant*

I also heard that one "features" of Sobig is that it will copy itself to any visible network shares. Fortunately, due to some bug(s) in the programming, this does not work.

Ah, I read it here.

you'd be suprised...

Altough most are worms, there are about 50-60 virus existing.

Symantec: 1592 results found (includes articles)
Mcafee: found 58 record(s) matching

id didn't creat this.. hmm...

Looks like in addition to all the garbage we've been getting as a result of this virus propagating (the virus itself, attachment-free e-mailings by the virus, mis-directed automated notifications that "Your mail server sent us a virus", bounces to people whose addresses were spoofed by the virus, probably etc.), we can expect the infected computers to start being used as relays for the sending of "normal" spam -- with the corresponding spike in spam volume that would bring.

According to this article:

After examining two month's worth of junk e-mail earlier this year, New York City-based e-mail security company MessageLabs found that roughly 65 percent of spam originated from computers running proxy servers. More than 75 percent of those servers appeared to be installed on PCs that showed signs of being infected with Sobig and similar viruses.

And Symantec:

Sobig.F can download arbitrary files to an infected computer and execute them. The author of the worm has used this functionality to steal confidential system information and to set up spam relay servers on infected computers.

Let's say that user's computer gets infected with W32.Sobig.F@mm. Well, the worms starts sending

itself to all the email addresses it finds in the files that have the following extensions:
* .dbx
* .eml
* .hlp
* .htm
* .html
* .mht
* .wab
* .txt

(See Symantec description.)

It's reading your "hidden" address from browser caches on infected machines of people who've visited your web pages.

The Cheese worm did this on compromised Linux systems a few years back. The antivirus industry, in accordance with Linux sysadmins everywhere, added detection for the worm. A virus is a virus, and any unauthorized access to a computer is a Bad Thing.

Here is HouseCall - Their online free virus scanner.

Anyone without an antivirus program seriously needs to get one:

McAfee

Symantec (Norton)

Trend Micro

Just to name a few...

There was an AppleScript worm. I suppose you could call it 'the applescript worm'. Of course, it required a Microsoft mailer to propogate.

(har har.)

The Cheese worm did this on compromised Linux systems a few years back. The antivirus industry, in accordance with Linux sysadmins everywhere, added detection for the worm. A virus is a virus, and any unauthorized access to a computer is a Bad Thing.

If a private citizen were to show the interconnections of the power grid on their website, what would happen? How long would it be before the government ordered him/her to remove that information in the interest of "National Security"? Why is it that CNN can show it freely? A similar map was being broadcast on TV all morning.

And as for how the software works, it would be interesting to know just what OS the power company computers were running. Not to sound like a conspiracy theorist (well, ok, that's exactly what I'm trying to sound like ;) ) as soon as there were variants on the Blaster worm, a large section of the power went out? Hhhmmm...

if you don't already know, head on over to Symantec's blaster removal site to fix any systems that have already been infected.

there are many systems infected on our apartment network, and everyone is looking at me to fix them.

i think i will wait until sometime next week. i mean, how many times can you legally DOS microsoft?

this should be fun...

Check out Symantec's ManHunt. Besides getting great support, this uses open source software (snort) and now runs on Red Hat Linux!

Successful Wednesday, July 16, 2003 Security Update for Windows XP (823980) Web site
Buffer Overrun In RPC Interface Could Allow Code Execution (823980)
W32.Blaster.worm

I just want to say LOVE YOU SAN!!
billy gates why do you make this possible ? Stop making money and fix your software!!

Or perhaps W32.Randex.E which explots the same DCOM RPC vulnerability as MSBlaster.

I'm gonna stick to the Backdoor.irc.Cirebot theory just because I think this one has been more widespread.

See MS03-026

If the other worm you are talking about is hitting port 445 it is probably the Backdoor.irc.Cirebot trojan. It targets port 445 (vs 135), and opens up a backdoor. Its still an RPC attack though...

Hopefully, the other worm you are seeing isn't a mutation.

Let's patent applications that run in Outlook. I can't think of any similar prior art.

Let's patent applications that run in Outlook. I can't think of any similar prior art.

Let's patent applications that run in Outlook. I can't think of any similar prior art.

Let's patent applications that run in Outlook. I can't think of any similar prior art.

While you should have the MS03-010 patch installed, it is the wrong one for this worm. Make sure you use MS03-026. This is the patch that it links to in the removal tool link.

Here's the homepage for Symantec's tool which removes this worm.

>It's been hitting efnet for the past week
Uh, I think the lame trojan backdoor.irc.cirebot is a different thing to the worm that this story is about. It used the same hole to install a backdoor but didn't spread on its own.
Some irc networks make your ip address visible to others, I suspect kids were manually launching cirebot at people.

The blaster worm which this story is about dosn't seem to be anywhere near the scale of code red. Yet. I'm seeing a couple of incoming connection attempts an hour to 135 and 445 which is normal.

SecurityFocus has an analysis for the worm here.

here. Includes snort signature etc.

Just FYI, I've confirmed on my system that at least some of the parent's information is true. I got hit around 2pm Dallas time, and I've now got a file called msblast.exe in c:\winnt\system32 with a file length of 6176 bytes.

After the "to say LOVE YOU SAN!!" string, I find these words: bill gates you make hi possi. And before it, it looks like it says "I ju wan to say" (with control characters that may or may not be of interest).

Sure enough, Symantec has some info now, too (just sent by someone in my co.).

Timing sucks on this one -- I'm right in the middle of coding for 3rd quarter tax changes. Crap!

according to the Federal Trade Commission (FTC) [...] responding to spam may actually result in even more unsolicited email as these responses confirm to spammers the accuracy of the targeted email address. In fact, the FTC recently conducted a study wherein the Commission and law enforcement partners tested whether "remove me" or "unsubscribe" options in spam were being honored. Their findings showed that 63 percent of the removal requests were not honored.

Next time there's a thunderstorm warning in your area, watch your front door. When somebody from the National Weather Service arrives to personally inform you of the warning, you be sure to let us know, OK?

And don't forget that, long before Outlook existed, malware writers were tricking unsuspecting users into falling for trojans and hoaxes by claiming to be from Microsoft.

Judging by the the amount of traffic the machine in question is going to deal with, a "point, click and go" solution isn't going to cut it. It needs to be reliable, stable, and not vulnerable.

Unfortunantly, Microsoft can't keep my web browser from being constantly attacked by unscrupulous websites and other bits of malicious code. Why should anyone trust them to build a stable webserver?

Before upgrading to SP4, make a back up! I will on my workstations. Use a drive image software like Norton Ghost. If SP4 is bad, then restore the image(s). These utilities are life savers. :)

> What exactly do you call a stream in that context?

Symantec, NTFS Streams primer

Carvey, "The Dark Side of NTFS"

more...

BTW, two PC forensics packages we looked at recently didn't know about NTFS streams...

I know there is at least one gaping security hole in NTFS. By now, however, it is probably a class of vulnerabilities .

I can Ghost an 80 gig drive in under 10 minutes. There are other commercial products.

I have far too many other projects that could use 6-7 hours...

//cow

We could also implement a freedb-like data base for virus hoaxes. Anyone who tries to forward a known virus hoax gets zapped and IE opens a hoax explanation page so they learn to check first.

Imagine how much safer the Internet could be!

Good probability ... although Symantec currently has a great product for corporate use, (see it here) including Exchange mail filtering/virus scanning (Symantec AVF), and server/client management utilities that are great (Symantec AV Corporate Edition) that have proven very useful to our business in the past. I think Microsoft would be in for some tough competition, unless of course they bully Symantec out of the job.

i'm sorry, this page certainly doesn't seem like "refusing complaints" to me.