W32.Sobig.E@mm Worm Spreading Rapidly

mabu writes "Apparently there is another worm spreading online. Symantec has upgraded its severity to 'category 3.' This worm appears to primarily affect Microsoft systems, has an expiration date of July 14th, and searches users' machines for select files containing e-mail addresses that it uses to propagate itself."

Comments

What Operating System?

[Anonymous Coward]

just kidding.

Re:What Operating System?

[Anonymous Coward]

It looks like you are being hit by another Virus!
Do you want to:
[ ]Contact Microsoft Support?
[ ]Dig out your backup and restore?
[ ]Finally get around to installing Red Hat?

They don't make em like they used to

[Raindance]

"This worm appears to primarily affect Microsoft systems, has an expiration date of July 14th,"

Yuck. The only thing worse than worms are rotten worms.

Re:They don't make em like they used to

[PovRayMan]

"This worm appears to primarily affect Microsoft systems, has an expiration date of July 14th,"
Yuck. The only thing worse than worms are rotten worms.

Hey now, worms taste good for a while after they expi--. Errr, nevermind..

Re:They don't make em like they used to

[questamor]

This worm appears to primarily affect Microsoft systems.

Is this a subtle way of trying to say "Yes it's another fucking windows virus" without sounding like we're anti windows?

Sometimes it's so hard just describing windows 'features' without sounding like I'm bashing it.

Re:They don't make em like they used to

[SnowZero]

echo "alias ls='rm -rf'" >> ~/.bash_profile

As usual, zsh users are unaffected. :)

Somebody angry at France?

[mscheid]

expiration date of July 14th

Well isn't this the french national holiday. Maybe somebody is angry because they didn't join the war against weapons of mass.. er, what was that war about again?

Ok so this might be a weird request.....

[scoobywan]

but can someone please write a good virus for once.
I mean back in the day virii actually did stuff,
now they just email over and over. Remember when
your computer used to get "Stoned" :P. So, instead
of bitching about virii, I just ask, if you're
gonna write one at least make it do something fun.

Re:Ok so this might be a weird request.....

[2Bits]

Yeah, just like this one we developed just for our "beloved" coworker a few years ago.

We all worked in the open cubicle land, and there was this guy always answered his phone with the speaker phone, and had the volume set to highest. Everyone heard and knew about all his dirty laundry with his wife (or girlfriend). Everytime after he had a dispute with his wife, he would swear at everything the whole day, and swear out loud . And he would bang on the drawer, etc.

One day, two of us decided it was enough. We wrote a little worm with a trojan. And this is just for his computer, it would not spread to anywhere else. After we sent it to the whole group as attachment, it would do nothing on other computer, and it would just behave funny on his computer. This is what it did:

- It would simulate, from time to time, like 15 times a day between 9am and 5pm, a BSOD by just popping up a blue screen and catch keypress and do nothing. This was easy, we downloaded the BSOD screensaver and used the pic.
- Whenever he started up his Outlook, it would send a .wav file containing a big sound of fart to the audio device (oh, did I mention he had a nasty speaker too, and that he liked those weird sounds attached to his system events?). Everyone knows how to do this right?
- Whenever he sent emails to his wife (he always told people about his wife's email, for some reasons), another stupid email is sent to his boss, about him complaining about women in general (we had a few simple templates for that :) This one was a little tricky, as it was the first time we hacked Outlook.
- it would send some system binary file, picked in random from the system32 directory to the audio device. This would produce some weird scratchy sound. This is done a couple of times, especially between 12pm and 1:30pm, after lunch, when he was half asleep.
- it would try to pop up some weird shit on his screen, by picking in random some file from the system32 directory.

Boy, the farting sound makes him so embarrassed, after everyone is complaining that this was gross (as if he wasn't gross enough before that!).

I left the company about a month after we did this, not sure what happened to him (and I didn't want to know anyway, obviously).

Re:"Primarily affect"

[barcodez]

Might be able to get it to run under wine (yes I am joking).

Microsoft -- obligatory Simsons...

[dcmeserve]

> This worm appears to primarily affect Microsoft systems

<Nelson>

Ha - Haah!

</Nelson>

And now...

<Hanz&Franz>

Once again, ha haa! I lauugh at you silly foolz, with your flabby Windowz and your buuggy virus-baiiting Outlook email reader. I sit here with my puuumped-up Linux system, and my maanly Mutt text-only mail reader, and I open up my spam and virus emails and lauugh again because they cannot haarm me!

Ha Haaaah!

</Hanz&Franz>

Another story dupe?

[Anonymous Coward]

Wasn't there just a Windows worm story last week?

Re:"Primarily affect"

[TheMidget]

It only affects Microsoft systems, just like every other friggin' virus on the face of the planet.

Nope, there are also viruses affecting Macs. And worms affecting Apples. For example, yesterday at the cafeteria, I had an apple whose security had been breached by a worm.

MOD PARENT UP + read my insightful comments ;-)

[fmaxwell]

As the parent poster said, a malicious person trying to do maximum damage would write for Windows. The Mac is the next best choice because, like Windows, you don't have big binary compatability problems.

Linux is tougher to write this kind of thing for because it would require that the user perform so many steps. First the user would have to extract the tar file from the gzip file. Then he would have to expand the tar archive onto his hard drive, which would put the source there. Then the user would cd to the location where the source extracted. Then he would probably have to set various environment variables. Then he would have to run gmake. Then he would need to interpret the error messages to determine why the build didn't work. Then he would have to find and add various development tools and libraries to his system, adding any environment variables that they needed. Then he could try building again. When he finally got the build to work, he could then run the resulting executable, which would tell him to to type "man {trojan/worm name}. The man page would show various command line switches for specifying the e-mail client being used and various network options. Then the user would construct the proper command line to run the program and WHAM! Just like that, his system is infected.

I may have left out a few steps or so, but you get the idea...