Slashdot Mirror
Today's Windows Virus - MyDoom / Novarg
Oddster writes "There is a new virus out by the name of Novarg which can infect all Windows versions from 95 to XP. It has two interesting features - first, in addition to mass mailing, it also distributes itself via the P2P network Kazaa. Second, it can perform a denial-of-service against www.sco.com. Details at Symantec
and F-Secure, although neither seems to have finished their analysis." Other readers have sent in links to coverage at CNET and Security Response, and Russ Nelson provides a sample message.
Finally, a worthwhile virus!!
Common sense is not so common.
i just got the patch off of kazaa... sweet jesus, just in the knick of time.
whew.
i was scared there for a ss.....[NO CARRIER]
MARIJUANA, SHROOMS, X: ONLINE?! - E
"Second, it can perform a denial-of-service against www.sco.com" Will this be the first virus I willingly load on my machine?
"Second, it can perform a denial-of-service against www.sco.com."
How do I get it?
Sdelat' Ameriku velikoy Snova!
Who the hell is gonna open a 3kb executable from kazaa?
--
WHO ATE MY BREAKFAST PANTS?
Ok -- which one of you wrote this.....
10b||~10b -- aah, what a question!
Back in my day, viruses came in via the boot-sector of floppy drive. You actually had to know fudge to write one.
You yung whipper-snapper virus writers and your MS holes got it way too easy.
On one hand it seems to be written by the RIAA, on the other it looks like some linux loony, can it be both?!
That's a message from God!
This
5 posts so far, and 3 of them are of the "I WANT TO PARTICIPATE IN A SCO.COM DDOS" variety.
people... that is illegal and not the way to win the fight.
i'd say more, but i have to go load that virus on my 3 other laptops.
MARIJUANA, SHROOMS, X: ONLINE?! - E
To show that there are no hard feelings after the virus enterd my work network, I would like to invite the virus writer to play a game of baseball.
Just show up, I'll brng the bat!!!!!!!
Attempt to enter some code into some random OSS project that DoSes www.kernel.org or www.gnu.org or something like that then make a big media spectable out of it. Reveal 'hints' that point to some SCO fanatic inserting the code. On that note, I think SCO is capable of writing a virus to DoS their own site just to get some good PR ammo.
Hate me!
It is DoS'ing SCO - a million slashdotters descend upon the SCO webpage to see if it still stands.
I am one of many. My idea is not unique, nor do I expect my voice alone to sway you. I speak in a chorus of opinion.
Looks like you've figured out how the ddos works. Put "www.sco.com" in the virus, get it mentioned on Slashdot, and the /. effect takes down the site.
Hear recorded Slashdot headlines on your phone! New service beta testing. Just call (248) 434-5508
So who has the motivation? People who've shorted SCO stock and need it to fall, so they can cover their position. People who've invested in SCO and need a reason to sell off without explaining that they bought into something stupid. Not us.
Humour aside, if that was the intention of the virus, it should bring down the SCO email server (mail.sco.com) as well as www.sco.com. This would hurt sales and cause a major inconvenience.
SCO's lawyers are probably 'creating' a lawsuit as we speak - claiming the portions of the virus are SCO IP. (Which is just as believable as Linux containing SCO's code.)
SCO could also have written the virus - to hurt the image of their competition.
Here's the google cache of the sco site for when the virus takes over.
SCO, killing orphans and nuns since 1999.
riding round the world on an old motorcycle
No one likes virii... Then again, who likes the SCO either?
Buckethead
Grandfather (gruff Northern English accent): "In my day a virus was a proper virus, it destroyed your hard drive and wiped away your entire silicon existence but we held together lad, together"
Grandson (wide eyed): "Was that when you had keyboards granddad? Crikey. Pass the DNA-USB dongle over please..."
I've noticed that everyone who is for abortion has already been born - Ronald Reagan
Does the virus install it's source, whine about the GPL and insist on being called GNU/MyDoom?
I DO in fact have a paypal account and am willing to accept donations for my contributions to society.
Send donations to:
wenNOdoy@SPAMconsolidated.net
I hadn't seen one until I started reading this story on here... then I got 2....
Strange coincidence.
---- Booth was a patriot ----
Amen to that! Stupid virus authors, giving a bad name to all us honest respectable SCO-haters... *grumble*
I always download the attachments that say "I love you."
Sure, it might be a virus... But I can't take the chance I might miss a secret admirer.
> 1) It has a simple text message plus a binary payload attachment.
:-/
> 2) It uses no M$ exploits (patched or unpatched) to install itself.
> 3) It depends on someone opening the attachment to start an infection.
Compared to the real world this would be something like:
"Whoa! Theres a black, unmarked bottle on my doorstep that reads 'Returned to sender'. I am quite f*cking sure I did not send this bottle in the first place. So why don't I open and drink it? It can't be dangerous!"
Anybody with some common sense would not act this way IRL, but with computers its all different...
I pity the state of the union
cd pub; more beer
First you save the attachment.
Then you unzip it.
Then you execute it.
Why do the virus writers even bother writing code? If people are willing to do all that, it sounds like the next virus will consist solely of the text:
"Pick a friend at random. Go over to his house and bash his computer with a sledge hammer."
ping www.sco.com
/dev/null
ping -f www.sco.com
or how about a crontab entry?
* * * * * wget -r http://www.sco.com
>Now Darl seems to have some credibility with the Linux == terrorism threat.
No, he doesn't; it's a Windows virus, not a Linux virus.
Windows == terrorism
Proof that Windows is a danger to national and economic security.
I don't know the meaning of the word 'don't' - J
Alright. Now listen up. Here's the deal....and I'm not accusing anyone...I'm just saying...
"The worm encrypts most of the strings in it's UPX-packed body with ROT13 method,"
I *KNOW* it was one of you fuckers...
OBVIOUSLY, this is an attack my Al Queda operatives... now before you mod me down think about this.
By attacking MS and SCO, they have given both companies leverage against Linux and more FUD than they could create by themselves.
These terrorists obviously want the US government to back those companies and drive useful (i.e. robust, efficient and able to be used against them) software out of the market.
Once, SCO and MS run things in the US no one will be able to recieve any more useful information or get work done.
Not to mention the citizens of the US will be so mired down in our inefficient and secured through near martial law practices that they will be too apathetic to care, and too slow to react.
A brilliant masterstroke...
Woot!!! I'm off the hook. I can let the AV Server slowly distribute the update through the week rather than panicking and running to every system to make sure it's up to date. Take that .com mies! :)
it can perform a denial-of-service against www.sco.com. Details at Symantec and F-Secure, although neither seems to have finished their analysis.
.. lets take our time over this.. no need to rush things now is there? I mean - we wouldn't want to make a mistake or anything now would we?
Cut to the labs of the antivirus companies:
Sir! The new virus seems to launch a DDoS against sco.com!
REALLY? Great work! Now
Take a 2 day lunch.
who it is that is opening email, saving attachments, opening the attachment, running the payload, and is not using AV software. I mean that is a lot of work by someone with at least *some* clue about email. Who is doing this? Is there a profile? Is it generally a home user, or generally at a public school?
Well, so far, four people out of those allowed to send mass mailings to all Computer Science students at a Penn State branch. Glad to know my parents (and taxpayers, etc.) are getting their money's worth.
This was probably done to defame us
:)
With 3 SCO posts a day, I already figured www.sco.com was under constant DOS from this community
the sync.c,v line is, if i'm not mistaken, a CVS version header. Very likely a linux author. Now all we need to do is round up all the CVS using Linux hackers named "Andy"...
For the first time in my life, an email virus has actually ended up in my inbox.
:)
*sniff*
Im so happy. Somebody actually has me in their address book.
How long before SCO claims ownership over this code too?
Yeah, I suggest removing all CD/DVD/Floppy and whatever drives and ripping the network cable out of the wall. Better yet, disconnect the power supply... Voila - secure system.
This comment does not exist.
I've even heard a guy who claimed that the anti-virus companies' employees write the viruses... eather with the companies' knowledge or not. He claimed that they did this to "keep the demand up for AntiVirus software." Now that's scary.
A good friend of mine works in the anti-virus industry. I asked him the same questions abous them making their own viruses to stay alive. His reponse was: "We still get enough business to stay alive from sircam and friends. If we wrote and published our own in addition, we'd be bigger than Microsoft now."
and to ad insult to the inury a reply
from MS Expert Christopher Budd:
From the press:
Christopher Budd, a security program manager
with Microsoft, said the worm does not appear to
take advantage of any Microsoft product
vulnerability."
Squeeze me?
Baking powder?
Where does the adress books(key ingredient
to the virus transport mechanism) come from?
Unix PINE?
Gnome EVOLUTION?
talk about a moron from moronia!
- these are not the droids you are looking for -
Google now shows Caldera as the first hit for a search on "litigious bastards", while www.litigiousbastards.com (a site about SCO) comes up about five down. Go team!
do not read this line twice.