Sharpei Virus Written In C#

josepha48 points to a CNET article on a new worm written in C# and partly aimed at the .Net framework, excerpting: "On Friday, antivirus companies received a copy of a worm called Sharpei, which is partially written in Microsoft's newest computer language, C#, and designed to infect computers loaded with the .Net framework."

Comments

Re:It's NOT a .NET virus!

[Anonymous Coward]

With the sig too, that's beautiful irony...

Re:It's NOT a .NET virus!

[rjamestaylor]

• The virus is _NOT_ a .net program, it's NOT running on the .net platform and it's NOT messing around with files from managed code.

So, its a .NOT virus...

social engineering

[hiroko]

You've got to love the message in the email:

Hey, at work we are applying this update because it makes Windows over 50% faster and more secure. I thought I should forward it as you may like it.

Re:social engineering

[Shiny Metal S.]

This is nothing! Have you heard about the "Don't F***ing Open Me!" Virus?

E-mail inboxes were flooded with messages this morning as a new virus quickly spread around the world. Dubbed "Don't Fucking Open Me" by anti-virus researchers, the infected e-mail follows a similar course to other viruses and replicates by sending itself out to everyone in the infected computer's Outlook and Outlook Express address book. The virus also contains two different payloads: one version formats the hard drive and displays the message "This is for your own good"; the other payload creates random Power Point presentations in the "My Documents" folder.

Savvy users can spot the virus by its subject which is "Don't Fucking Open Me" or by the attachment which is entitled "Don't_Fucking_Open_Me.exe".

"This virus tricks the user with an old psychological tactic called reverse psychology. Apparently the curiosity created by the message has been too much for thousands of users," said anti-virus researcher Bob Atibop. According to Atibop, this isn't the first time reverse psychology has been used. In 1998, the "Don't Pee on Your Keyboard" worm caused a flood of damage.

Researchers have seen large infection among AOL users and middle managers, the two largest concentrations of naive and inept computer users.

Claudia Hawkins who was infected by the virus said, "My son told me not to open attachments, but.... I mean my MOM sent it! What if she was hurt?!?"

Another infected user too embarrassed to reveal his name said, "I thought that there was no way that this could be a virus. What kind of stupid idiot virus writer would put a dumb title on it like that? No one would ever open something that says not to open it. The virus would never spread defeating the whole purpose of it."

Experts advise extreme caution when opening messages entitled "Don't Fucking Open Me" or "Click Here for Cash and Virus Infection".

Re:You knew it was going to happen

[Anonymous Coward]

Actually it is the AV researchers who give the name. Virus writers usually 'suggest' a name but this is almost never used. Usually we aim for a name that would piss off the writer.

Who said it was a .NET virus?

[Anonymous Coward]

Let's try your karma whoring strategy:

It's NOT a pink elephant!

Just trying to clear up a potential misunderstanding here: The Sharpei Virus is a worm spread by MAIL via Outlook. It has NOTHING to do with elephants, mammals in general, or any kind of pink lifeform. The virus may overwrite some files if the user has write access to them, but rest assured that you won't have to deal with 10,000 pounds of pink flesh suddenly appearing in your computer room.

Re:Who said it was a .NET virus?

[saintlupus]

rest assured that you won't have to deal with 10,000 pounds of pink flesh suddenly appearing in your computer room.

Ah, so the admin found his pants, then?

--saint

M$ doesn't call Sharpei a worm

[Ilan Volow]

They prefer the term "a few wrinkles here and there"

SSSCA Impact on Viruses

[heretic108]

I worry about SSSCA.
If it goes through, virii would definitely fall under the category of 'interactive digital devices'.
It will be illegal to write or transmit a virus unless it contains 'approved security measures'.
Any attempt to circumvent a virus' protection mechanism, or communicate to others the nature of a virus or possible defences against it, will be a criminal offence punishable by law

Re:SSSCA Impact on Viruses

[heretic108]

virus, n.
1. A computer program intended to replicate itself throughout multiple computers without the user's consent.
2. A licensing condition applied to computer software which allows users to understand and modify the programming code used.
3. virii, pl. Computer programs written without the express support or approval of Microsoft Corporation or its strategic partners, which threatens national security by undermining Microsoft's ability to control the global use of software in personal computers.

(Source: Microsoft - New Employees' Orientation Handbook)

Re:Go to sleep Timothy

[MiTEG]

Go to sleep for gosh sakes. You've been posting since Noon yesterday.
My god you're right! Timothy has has less than 3.5 hrs between posts for the past 24 hrs! A quick breakdown of Timothy's postings:

March 03 3:15 AM
March 03 6:47 AM
March 03 8:29 AM
March 03 11:59 AM
March 03 12:22 PM
March 03 12:57 PM
March 03 2:16 PM
March 03 3:56 PM
March 03 5:19 PM
March 03 5:35 PM
March 03 5:46 PM
March 03 7:47 PM
March 03 10:35 PM
March 03 11:11 PM
March 04 3:17 AM

I say go for another 24 and then see what happens, turn it into a sort of geeky endurance test or something.

Re:EICAR Virus Test file

[gazbo]

Noted, bookmarked and downloaded, cheers. Well, downloaded once I persuaded my virus scanner to stop buggin me about it.

Re:It's not a virus

[x0n]

It's not a single click to execute attachments, it's double click; ergo you need to be twice as stupid as some to run an executable attachment sent to you unannounced.

Wording

[GSV NegotiableEthics]

Hey, at work we are applying this update because it makes Windows over 50% faster and more secure. I thought I should forward it as you may like it.

Something about the wording suggests to me that this worm is intended to target only very stupid people. Does anybody reading this actually have friends who write emails like that?

Re:Great Advertising

[Tony Hoyle]

You're shitting me... there are .NET users?

Wow.

Already happened

[sheldon]

Outlook2000 has a patch entitled "Fix stupid user", which prevents users from opening attachments. Outlook XP ships this way by default.

Granted, the patch also does some useful things like changing the profile under which email is viewed to Restricted Sites Zone, thus disabling active scripting, etc.

And if some user still insists on running that .EXE, the patch pops up when things connect to the Outlook COM objects and says "Hey, this thing is trying to send email.. is that ok dummy?"