Slashdot Mirror
New Worm Spreads Via MSN Messenger
vxone writes "Anti-virus experts are watching a new worm that spreads through Microsoft Corp.'s MSN Messenger client. The worm is not harmful to infected machines and has infected only a few PCs at this point, according to an analysis by Trend Micro Inc. Known as Jitux, the worm is self-propagating and contains a link to a Web site that automatically downloads an executable file named 'jituxramon.exe' to the PC. Once the file runs, the worm begins sending out copies of itself to all of the names in the user's Messenger contact list."
For anyone who has tried to uninstall MSN messanger, you know how much of a bitch it is. I recommend Windows XP antispy to get rid of it.
:)
After all, (simpsonism) "no one who speaks german could be evil (/simpsonism)
To make laws that man cannot, and will not obey, serves to bring all law into contempt.
--E.C. Stanton
It doesn't seem to be using any particular vulnerabilities in MSN. It depends on users to click on a URL they receive in a message.
Now what responsible user would do that. NAI's web site claims that the worm code itself has been removed from the web server, thus rendering the worm harmless:
http://vil.nai.com/vil/content/v_100931.htm
-- Update 31st December 2003 --
This threat is considered to be a Low-Profiled risk due to media attention at: http://www.web-user.co.uk/news/47502.html
This detection is for a worm intended to propagate via MSN Messenger instant messaging. The worm is written in Visual Basic.
It propagates by sending messages to the MSN messenger contact list. The messages contain a link to the worm itself:
http://www.home.no/( removed )/jituxramon.exe
When the link is clicked, the worm is downloaded to the target machine.
Note: at the time of writing the the worm was unavailable from this URL.
If you must use MSN and don't need file transfers, I recommend you register a Jabber account at any Jabber server, and use a MSN gateway, and try to convince your friends to move to Jabber.
I've done it already, and my MSN account is redundant!
copy and paste into a .bat file
C HINE\SOFTWARE\Policies\Microsoft\Me ssenger\Client]>>%temp%\noe gr .reg% \nomsngr.reg /s %temp%\nomsngr.reg
:)
@echo off
echo Removing Microsoft Messenger...
rundll32 advpack.dll,LaunchINFSection %WinDir%\inf\msmsgs.inf,BLC.Remove
echo Disabling it from running in the future...
echo REGEDIT4>%temp%\nomsngr.reg
echo
[HKEY_LOCAL_MA
msngr.reg
echo "PreventRun"=dword:00000001>>%temp%\nomsngr.reg
echo "PreventAutoRun"=dword:00000001>>%temp%\nomsngr.r
echo "PreventAutoUpdate"=dword:00000001>>%temp%\nomsng
echo "PreventBackgroundDownload"=dword:00000001>>%temp
echo "Disabled"=dword:00000001>>%temp%\nomsngr.re g
regedit
run and bam! messenger is gone for good
+++ David Watts 5495 0.0 0.5 1888 884
Many of the newer 'user friendly desktop' Linuces run as root, such as Lindows. While I think this is horribly stupid, it doesn't stop the fact that many neophytes to the Linux world will be running Gaim or equivalent as root.
.
"...Ah if only application firewalls were standard issue like virus scanners..."
OS X comes with ipfw preinstalled, and it can be turned on with a couple of mouse-clicks:
Apple Menu->System Preferences
Select 'Sharing'
Select 'Firewall' tab
Click 'Start' button
There is also a tab with a list of service that one can check on or off, and it is easy to add new ones (click the 'New...)
Seems that I've read some debate of the merits of ipfw vs. other firewalls, but it seems to work fine for me. Also, there is the debate about whether or not it should be on or off by default. Personally, I think it should be on.
As far as headless apps, like daemons, I don't know. OS X asks for an admin password any time it needs 'root' access; if one makes sure they know what they're installing, and trusts the source, then I don't think anything too bad could happen.
Although, this just occurred to me. Could something like this launch an app in the background that captured keystrokes and saved them to a non-secure file/folder? That could be a problem.
(tig)
Ignorance and prejudice and fear
Walk hand in hand
According to Network Associates "at the time of writing the the worm was unavailable from this URL".
Using HTML in email is like putting sound effects on your phone calls. Just say <strong>no</strong>.
Click here to disallow anyone or programon your computer to use messenger
Works for XP pro only I believe
Programs execute with the same permissions as the user, though this happening is not very likely. For this to occur, two things have to happen;
Neither are impossible, though these are unlikely. (Some apps might skip the first step, though this is also rare.)
Keep in mind that unlike Windows, Unix-style systems don't use the name of the file or it's extention (suffix) to determine if a file is an executible. If Windows followed the same model, you could click on worm.exe and Worm would not run automatically.
A firewall can not protect you from yourself. Turn off what you do not need. Do not use the firewall to do your work.
Well, files by default are not executable, so it wouldn't execute unless you ran chmod on it. Furthermore, ports 0-1023 are privlidged by most unixes, and can't be bound to unless you run as root, stopping things like spam mail servers.
I still have more fans than freaks. WTF is wrong with you people?
Not if it downloads it using the open command. I presume the download is small so it would not be long until it downloaded and opened itself automatically. By then when the user realised the download was taking place it would be too late. But as people say it's harmless so I'm not worried.
):
AIM and YIM have been around a lot longer and no one ever wrote a "worm" (debatable label in this case) for those...
There are worms for ICQ, AIM and MSN. Yahoo IM is the only one that doesn't have a worm right now.
MSN worms have been around for a while now. This isn't news in any way. The worm relied on a website that is now shut, so the worm is effectively disabled.
If you want to know about IM spreading worms, read this or this
A number of the worms linked to spammers and DDoS attacks on anti-spammer sites have been multi-stage jobs. Once a PC is infected, it either scans for or waits for contact to pull down the next stage. (Sort of like a Wormdows Update feature.)
One line blog. I hear that they're called Twitters now.
I kept getting IM bots sending me links to random porn sites since its 'peak' time when it appeared on almost all my friends' profiles. I found the fix here and sent it to my friends. Since their fix, I've been getting less spam.
I would use gAIM but I found that AIM with the final free DeadAim saves more resources on my system.
I totally agree.
For those who don't know how, you can uninstall the thing by running:
RunDll32 advpack.dll,LaunchINFSection %windir%\INF\msmsgs.inf,BLC.Remove
I guess that I tend to want to err on the side of caution. Include a paper flyer with each new computer explaining in detail the firewall, and how to disable it. Or make it part of the first-time set-up. Design it in such a way that the end user has to go out of their way to not read it (can't continue until the page explaining the firewall has been scrolled down to the bottom or some such).
As far as disrupting some functionality, I hear you, but OS X seems to be mostly free from these issues, at least for home-use. I have the firewall up and running on both our Macs (PB G3 300 and iMac DV 400), and share a printer between them with no problems. I can also connect via SSH, FTP, SMB/CIFS, AppleTalk or Remote Desktop with no issues, although I don't keep them all on. The only problem I've encountered are external FTP sites that have problems with passive ftp.
Of course, YMMV.
(tig)
Ignorance and prejudice and fear
Walk hand in hand