Slashdot Mirror

← Back to Stories (view on slashdot.org)

Targeted Worm Hits Kazaa's Network

Posted by timothy on from the worms-churn-the-earth dept.

sh0rtie writes: "Kaspersky Labs and the BBC are reporting that the Fasttrack network that Kazaa uses has been hit by its first targeted worm virus dubbed 'Benjamin.' Is this a clever RIAA creation or that of a mischievous virus writer? I guess we will never know, but the result is that it seems to be bringing unsuspecting users machines to a crawl with full hard drives and clogging up the Fasttrack network with massive amounts of traffic bringing more headaches for ISPs and sysadmins worldwide."

8 of 300 comments (clear)

  1. of all days.... by jeffy124 · · Score: 5, Interesting

    the day the secret Kazaa/Brilliant network came to life is the day that this worm gets let loose.

    --
    The One Rule Of Chess You'll Ever Need: Don't play someone who carries a kit in their bookbag.
  2. Next Time A Warhol Worm? by cybrpnk2 · · Score: 5, Interesting

    Some very scary research has been aimed at discovering just how fast a worm could infect the entire Internet. This is the so-called Warhol worm, so named because instead of getting 15 minutes of fame, it would only take 15 minutes to infect the entire internet. If some nut combines a Warhol worm with a Kazza worm, we are in deep trouble.

  3. Infected? by rkent · · Score: 5, Interesting

    Okay, so... who's infected? any slashdotters get the

    "Error:
    Access error #03A:94574: Invalid pointer operation
    File possibly corrupted."

    message yet? If so, what did you do to clean up? Neither of the 2 articles gives a very good indication of that; I guess I'd start by deleting \windows\system32\explorer.scr and \windows\temp\Sys32, and removing these registry keys:

    HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Cu rr entVersion\Run]
    "System-Service"="C:\\WINDOWS\\SYSTEM\\EXPLORER. SC R"

    [HKEY_LOCAL_MACHINE\Software\Microsoft] "syscod"="0065D7DB20008306B6A1"

    Seems like that should keep it from spreading, but that won't prevent a reinfection. Oh well; at least there's a popup notice when you get infected. that's nice.

    Looks like fasttrack users (kazaa, morpheus, AND grokster) are catching on... about 1/5 as many users on as usual for this time of day. And before you flame me as a pirate, I only trade Simpsons episodes which aren't available for sale yet :)

  4. Re:Clever RIAA Creation by Aexia · · Score: 4, Interesting

    Yes, quite irresponsible. After all, when has the RIAA ever done anything malicious to innocent computer users' systems?

  5. Cons-piracy theory by Kirby-meister · · Score: 4, Interesting
    A lot of people will probably put this on the RIAA/other copyright crusaders, but I see P2P networks as a huge market for propogating virii and sending people trojans.

    Large file-sharing networks like Kazaa have birthmarks in the shapes of bulls-eye's.

  6. For fear of stating the obvious... by Restil · · Score: 5, Interesting

    But if banner ads which will profit the creator of the virus are posted on every single infected computer... how hard would it be really to follow the money to find the author of the worm?

    Or was I the first one to read the article? :)

    -Restil

    --
    Play with my webcams and lights here
  7. Virus companies need the virus makers by bigmouth_strikes · · Score: 5, Interesting
    "This event once again demonstrates the necessity to filter all incoming files for viruses, regardless of how well protected this or any other network is. Before use all data should be run through a mandatory check for virus code using the latest virus database update," commented Denis Zenkin, Kaspersky Labs Head of Corporate Communications.
    Gee, I'm so grateful for Kaspersky Labs that they provide this valuable information. They only forgot to add

    "If you refer to this article, we'll give you $5 rebate off your next virus update purchase." added Zenkin with a smile.

    As much as we need the anti-virus software, the anti-virus companies need the virus makers. Without a worm or a virus that makes CNN headlines every 6 months, people will forget to buy updates, patches etc etc. The public forgets quickly, and will not buy new products from the AV companies if they don't feel a threat.

    Sure, the problem is real, but part of me can't shake the feeling that somewhere there is a anti-virus company executive ordering a new plasma HDTV when he sees this news. Or maybe it's just becase X-Files ended yesterday that I'm seeing conspiracies everywhere.

    --
    Oh, I can't help quoting you because everything that you said rings true
  8. adserver domain closed by Alan · · Score: 4, Interesting

    Hehehe, if you hit the page that the virus opens to get the author more page impressions (http://benjamin.xww.de/), you get:

    "
    Domain aufgrund von massiven Beschwerden gesperrt.
    Domain closed due to massive abuse.
    "

    Now I wonder if it was closed because someone wrote a virus, or because the virus worked so well he went over his bandwidth allocation! :)