Slashdot Mirror
Latest WinWorm Spreads Via ICQ And Outlook
mgooderum was among the many to write in about yet another snippet of malice making the Windows desktop rounds: "The latest email virus -- 'Goner' -- is apparently running around this morning (AP news story on Iwon here - no login needed). The virus is a typical worm that spreads via attachments and user's address books. It appears as a message with an attachment that starts: 'How are you ? When I saw this screen saver I immediately thought about you...' Goner is apparently non-destructive other than the normal DoS issues with the load from it forwarding itself everywhere. What's moderately unique are two features. One is its ability to replicate via ICQ as well as the usual Outlook and Outlook Express. Two is its small size -- it has a packed form that is only 159 bytes. Symantec has details here; McAfee has details here." Update: 12/04 21:57 GMT by T : That should read 159 kilobytes. And as many posters have pointed out, "destructive" is in the eye of the beholder.
It is not non-destructive - it tries to delete anti-virus and firewall software.
Eric Aitala
www.f1m.com
has already sent every one of my fellow employees all over the globe 27 copies of this thing.
.scr.
It's been going on for over two hours now. I can't help but wonder if he's still over there trying to run that damn
Thanks, boss.
Personal me, collaborative you
The story had a few errors:
it has a packed form that is only 159 bytes.
Actually the attachment is 38KB, and the virus itself is 159 KILObytes, not 159 bytes, UNPACKED.
The unique thing about it is it disables some anti-virus software, and things like ZoneAlarm.
As soon as virus writers learn how to spell correctly and learn proper grammar, I think we're going to be in some serious trouble.
"And like that
Didn't everyone get the memo that opening attachments is a really dumb idea? I'm attaching the original message:
<Attachment: Don't_Open_Attachments.eml.vbs>
I just got the warning message from my school's network goons. In a move of administrative widsom at its finest, it mentioned:
"The Bearcat Online email system is now blocking all messages with "Hi" as the subject."
This one's strength is actually its social engineering. The text of it sounds like something a friend would send. My sister got nailed and I got it via e-mail from her. Since I had just finished talking to her on AIM I found the text of it a little strange so my guard went up. Funny enough, McAfee didn't catch it on Yahoo (I scanned just to see what came up).
Our office blocks .scr attachments at the server, because we're not completely incompetent. There's no reason to send a .scr or a .vbs or anything like unto it - whatever you have to say could be said in a text file.
It strikes me as extremely sad that a virus like this can still work. How many times does it take?
What can we do to save the unknowing?
Let's not stir that bag of worms...
It says you have to remove the registry entry then reboot. Actually, if you remove the registry entry, the app reinstalls itself, then reboot doesn't do shit.
Shutdown to DOS, then del windows\system\gone.scr
(It's hidden attrib -s-r-h first), then reboot.
You can't delete it before you shutdown, it's 'in-use'.
If you're running NTFS, AND you've been hit, *sigh*..
"I can't give you a brain, so I'll give you a diploma" - The Great Oz (blatently stolen sig)
Well, since McAfee and Symantec are reporting it, I guess this is not a first draft of magic lantern... unless they issue another press release in 45 minutes saying "um... nevermind, there is no 'Goner' worm."
Don't be misled. Maybe you are too young to remember, or weren't in the industry, but the VB-based viruses are far tamer than some of the older Bulgarian viruses that used to attack DOS and Novell systems - those viruses would actually destroy the *hardware*. Unix has plenty of exploitable aspects - there was a vulnerability in pine that allowed for the execution of arbitrary code, there have been sendmail holes, worms, and other vulnerabilities. The unix model has been criticized by none other than RMS (when defending the HURD model) for its promiscuous reliance on SUID.
This virus has two real goals:
1 -- Proagate
2 -- Disable Anti Virus
This worm is a setup. So in a few days the 31337 h4x0rs will release the REAL virus that does the REAL damage to the people whose defenses have been compromised.
I love being a Win Sys Admin
Anyone need a an OSX admin?
This
The problem is there's *nothing* Microsoft can do to stop this sort of virus, as long as they allow execution of files direct from their email client, and honestly I can't see that stopping (and neither can the people where I work, which they're quite happy about :-)
I do worry for apps like this on Linux though, as email clients become able to execute attachments. But the benefit is that Linux doesn't assume things based on file suffix, but on their actual mime type. However, that still leaves a possible vulnerability to mime type spoofing, perhaps.
Matt. Want XML + Apache + Stylesheets? Get AxKit.
I am ashamed that anyone would intentionally use my Slashdot account name to bolster the popularity and reputation of their sick virus. I'm sure the hackers who created this monstrosity were well versed in such hacker tools as Bonzi Buddy and Lunix. If they think I would come out and support such a destructive screen saver they are very, very wrong. If God wanted toasters to fly, he would have given them wings.
So, you hackers, where ever you are, Goner (of Slashdot lore) does not approve!
That's why the LART was invented. If you can't get sense into 'em, beat it into 'em.
Yes, I actually kicked a user off the network one time because he already gotten _three_ warnings from me. And yet he still opened untrusted attachements.
*clicketyclick* no more DHCP lease, blocked by MAC address. His e-mail was directed to a temporary mailbox (so he couldn't get it from someone else's machine)
He never did it again. Good luser. After a few days I couldn't stand his whimpering and copied his mail back and reactivated his lease. Now he listened and behaved. Actually, it had a more positive effect: that story went around the office, and they now think twice before opening something they get from someone they don't know. Heck, some even switched from OutLook to something else (I've seen copies of Eudora and filled up Netscape Mail folders appearing on the workstations all of a sudden).
Sometimes you have to make it smart a little before they listen.
Thank god the people that write this kind of code are completely incapable of writing evil IDE command sequences that can fry hard drive firmware.
Imagine the destruction you could cause if after every infection and replication to everyone in your address book, it wrecked your hard drive and required it to be sent back to the manufacturer for repair?
Hmm, interesting sales pitch you could offer to Maxtor, Seagate, etc if you want to make a quick buck at the expense of the global economy. (unless the 90-day warranty covers "act of hacker").
You'd use MoveFileEx to get rid of the file, like so--
// buffer for system directory
// size of directory buffer
// string with environment variables
// string with expanded strings
// maximum characters in expanded string
MoveFileEx("C:\\WINNT\\System32\\Gone.scr", NULL, MOVEFILE_DELAY_UNTIL_REBOOT);
The combination of MOVEFILE_DELAY_UNTIL_REBOOT and a NULL lpNewFileName creates a special condition where Windows deletes the file at startup. This is commonly used by installers, for example, when a file is in use and DeleteFile fails. For anyone going through the trouble of putting this into an executable, you might want to grab the Windows system directory from Windows itself.. this can be done using GetSystemDirectory (prototyped as--
UINT GetSystemDirectory(
LPTSTR lpBuffer,
UINT uSize
);
) or you could be clever and use ExpandEnvironmentStrings, prototyped as--
DWORD ExpandEnvironmentStrings(
LPCTSTR lpSrc,
LPTSTR lpDst,
DWORD nSize
);
Shrug. =) Just thought this might help, for those unable to figure out how to delete a file in NTFS (but that do have a C/C++ or other compatible compiler).
All I know about Bush is I had a good job when Clinton was president.
Au contraire, mon frere! Just go to http://www.slipstick.com/outlook/esecup/getexe.htm #ol2002 and get the registry-editing instructions or downloadable tools to let you determine the Outlook 2000/2002 (XP) security settings on any type of file you want. I recommend the "Attachment Security Options" tool, myself.
Mmmkay, let's give this a try shall we?
1. Set up NTFS ACLs properly - this includes giving SYSTEM rights to what needs to have it, along with the Administrators group, etc. Users should only have read access. (Most experienced NT end-users should already have done this a long time ago; if you're on a properly set-up network, it should have been done already!)
2. Open up the MMC, go to users and groups, and add a user. Make it a member of the Users group, which you have already set up as to only have read access (heck, you can set it up to everything BUT delete access... NTFS ACLs are so specific and expansive it beats rwxrwxrwx hands down :-/) and also give it full access to its home directory under "Documents and Settings\user"
3. Log in as that user.
4. Open up a command prompt.
C:\>del /F/Q *.*
C:\New Text Document (2).txt
Access is denied.
C:\New Text Document.txt
Access is denied.
etc...
Oh wait, I didn't ever have to log in! Ever seen 2000's oh-so-cool "Run as different user" option on the property sheets? Guess not.
I think it's about time the zealots pull their heads out of their asses before they go and flame someone on a topic they know nothing about.