Slashdot Mirror

← Back to Stories (view on slashdot.org)

Today's Windows Virus - MyDoom / Novarg

Posted by timothy on from the are-you-virus-capable dept.

Oddster writes "There is a new virus out by the name of Novarg which can infect all Windows versions from 95 to XP. It has two interesting features - first, in addition to mass mailing, it also distributes itself via the P2P network Kazaa. Second, it can perform a denial-of-service against www.sco.com. Details at Symantec and F-Secure, although neither seems to have finished their analysis." Other readers have sent in links to coverage at CNET and Security Response, and Russ Nelson provides a sample message.

44 of 847 comments (clear)

  1. Finally! by someonehasmyname · · Score: 5, Funny

    Finally, a worthwhile virus!!

    --
    Common sense is not so common.
    1. Re:Finally! by Anonymous Coward · · Score: 5, Funny

      Is there a Linux port yet???

    2. Re:Finally! by MicktheMech · · Score: 5, Funny

      Not quite. This virus contains SCO IP. The DDOS is actually infected host sending credit card info to pay SCO $699 for the license.

    3. Re:Finally! by cyril3 · · Score: 5, Funny
      Yeah right.

      The last time someone told me I needed the latest virus patch I got into a shit load of trouble.

      And they were from Microsoft.

      You think I'm going to believe you. I hit that link and my soul belongs to some Romanian gangster.

      I'm not that stupid.

    4. Re:Finally! by Joel+Carr · · Score: 5, Funny

      You also need the Extra.DAT file which you can grab from here:

      In case the site gets /.ed, you can download the Extra.DAT file from me using Kazaa...

      ---

      --
      Any man who can drive safely while kissing a pretty girl is simply not giving the kiss the attention it deserves. -- AE
    5. Re:Finally! by Geek+of+Tech · · Score: 3, Funny
      So, uh where can I download a copy?

      --
      Stop the Slashdot effect! Don't read the articles!
    6. Re:Finally! by IthnkImParanoid · · Score: 4, Funny

      Check your email...I sent it to you (a couple... hundred... times).







      ---Note to John Ashcroft: the above was a joke.

      --
      It's nothing but crumpled porno and Ayn Rand.
    7. Re:Finally! by thedillybar · · Score: 5, Funny
      This doesn't make open source look bad.

      As far as I can tell, this virus is not licensed under the GPL, and I can't find the source for it anywhere...

    8. Re:Finally! by obeythefist · · Score: 5, Funny

      Ahh, so the idea is, the virus infects Windows boxes, then sends data to SCO to tell them that it's a windows box, which frees SCO to sue *everyone* else who doesn't attack them with the virus, because they must be running Linux. And we all know who owns linux, don't we?

      --
      I am government man, come from the government. The government has sent me. -- G.I.R.
    9. Re:Finally! by dslbrian · · Score: 5, Funny

      I think www.sco.com as we know it will probably have traffic from this virus FOREVER.

      Which they will promptly PR-spin into a positive thing - "We are getting THOUSANDS of licensing inquiries EACH DAY!!" or "Our website has become one of the most POPULAR on the internet, obviously customers are very satisfied!"

    10. Re:Finally! by XO · · Score: 4, Funny

      I still get a bunch of hits from Code Red in my logs, too.. from people on the same cable systems.. I'm collecting all their IP's , and am going to start a mass bomb of "NET SEND /DOMAIN:ip 'GET A GODDAMN ANTIVIRUS PROGRAM YOU FUCKING MORON'" ...

      --
      "Champagne for my real friends - and real pain for my sham friends!" http://ericblade.postalboard.com/
    11. Re:Finally! by Mr2cents · · Score: 3, Funny

      I think I'm going to re-install Win98 on all my machines.. They have been Microsoft-free for the last couple of years, but this virus really is a killer app!

      --
      "It's too bad that stupidity isn't painful." - Anton LaVey
  2. i'm not scared... by edrugtrader · · Score: 5, Funny

    i just got the patch off of kazaa... sweet jesus, just in the knick of time.

    whew.

    i was scared there for a ss.....[NO CARRIER]

    --
    MARIJUANA, SHROOMS, X: ONLINE?! - E
  3. DOS huh? by Armethius · · Score: 5, Funny

    "Second, it can perform a denial-of-service against www.sco.com" Will this be the first virus I willingly load on my machine?

    1. Re:DOS huh? by bsharitt · · Score: 5, Funny

      Damn it, they don't make enough Mac compatible viruses.

    2. Re:DOS huh? by PhxBlue · · Score: 5, Funny

      Will this be the first virus I willingly load on my machine?

      No, it'll be the second. You have to load Windows first.

      --
      !#@%*)anks for hanging up the phone, dear.
    3. Re:DOS huh? by nocomment · · Score: 5, Funny

      I thought that might be what you meant. Sorta like the honor system virus where when you get the email you just delete a bunch of random files yourself and forward the email.

      --
      /* oops I accidentally made a comment, sorry */
      /* http://allyourbasearebelongto.us */
    4. Re:DOS huh? by Nahor · · Score: 5, Funny

      It's well known that Windows is not a virus (shamelessly copied from here)

      1. Viruses are free.
      2. Viruses can be gotten from any good bbs.
      3. If detected soon enough, most viruses can be removed from your computer without a huge loss of data and time.
      4. Viruses don't take up HUGE wads of disk space.
      5. Viruses don't need 4meg of ram to run.
      6. Viruses do something.
      7. Viruses come in flavors, not just one-size-fits-all.
      8. Viruses use the "cutting edge" programming skills to make themselves less noticable. (untill they are ready to be noticed)
      9. Viruses don't have major bugs. (if they do, then they don't work, so they're not virus')
      10. Viruses don't have three different sets of documentation that is all mixed up and wrong.
      11. Viruses don't leak things to the press about the upcomming Jerusalem 95, to keep people from switching to Michelangelo/2 Warp or better yet, XJerusalem.
      12. Viruses don't put out stupid two page adds in magazines centered around the march 6 "activate button".
      13. Viruses arn't on every computer.
      14. Viruses don't have stupid wizards.
      15. Who cares if a virus is 16 bit, even though it is advertised as 32?
      16. Viruses don't say that they are user "friendly", when they arn't.
      17. Viruses can run on PCDOS without warnings.
      18. Viruses when installing themselves don't try to send private info about your computer over the phone lines to microstoned-net.
      19. Viruses install themselves.
      20. Viruses don't try to push out all compitition. They just try to do their job.
      21. Viruses maker's don't try to buy Intuit (makers of Quicken (wouldn't that be fun, America's biggest finacial software company owned by a virus maker))
      22. Viruses don't invade and take over PC Magazine, filling it with 100% junk on Win95.
      23. Viruses don't try to copy what Apple does.
      24. There are programs you can buy, or get free to remove viruses.

  4. Great! by Idou · · Score: 3, Funny

    "Second, it can perform a denial-of-service against www.sco.com."

    How do I get it?

    --
    Sdelat' Ameriku velikoy Snova!
    1. Re:Great! by nocomment · · Score: 4, Funny

      "Second, it can perform a denial-of-service against www.sco.com."

      Initial investigation on the Snort mailing list, seems to suggest that it opens up 63 threads that request sco's index page once every 300ms.

      I just installed it on all of my servers ;-)

      --
      /* oops I accidentally made a comment, sorry */
      /* http://allyourbasearebelongto.us */
  5. Serves people right.. by Breakfast+Pants · · Score: 5, Funny

    Who the hell is gonna open a 3kb executable from kazaa?

    --

    --

    WHO ATE MY BREAKFAST PANTS?
    1. Re:Serves people right.. by TheOtherChimeraTwin · · Score: 5, Funny

      Oooooh! Does drinking toner refills and spraying windex in your eyes give you SECRET powers?? I've got to go try that right away!

    2. Re:Serves people right.. by cyril3 · · Score: 4, Funny
      I brought a new Iron the other day and in capital letters in the instruction book I was told to never iron clothes while I am wearing them and that while I could use the shot of steam while the iron was in an upright position I should not forget the previous instruction about not ironing the clothes I'm wearing.

      I think perhaps the kind of people who would do that do not or cannot read the instruction book anyway but until you realize that you can feel a little unempowered.

    3. Re:Serves people right.. by johnalex · · Score: 5, Funny

      Gives a new meaning to the saying, "never underestimate the power of stupid people in large groups."

      --
      JA
      http://www.johnalex.org/
  6. DDOS SCO by forsetti · · Score: 4, Funny

    Ok -- which one of you wrote this.....

    --
    10b||~10b -- aah, what a question!
  7. Virus... by pardasaniman · · Score: 5, Funny

    Back in my day, viruses came in via the boot-sector of floppy drive. You actually had to know fudge to write one.

    You yung whipper-snapper virus writers and your MS holes got it way too easy.

    On one hand it seems to be written by the RIAA, on the other it looks like some linux loony, can it be both?!

    1. Re:Virus... by SiliconAddict · · Score: 5, Funny

      Boot Sectors?! You guys had it lucky.

      In my day we had to throw various insects into giant mainframe machines

    2. Re:Virus... by Haeleth · · Score: 5, Funny

      Ah, but back when I was a lad we didn't have machines to do it for us - we had to catch viruses ourselves by coming into physical contact with infected tissue.

    3. Re:Virus... by smittyoneeach · · Score: 3, Funny

      Tissue? Ohhh, how we would have wallowed in the luxury!
      In in my day, single-cell organisms floated about in the primordial ooze, dreaming of the abacus, and hoping to even spot a loose piece of RNA, much less contact it.
      And you try to explain *that* to the youth of today...

      --
      Get thee glass eyes, and, like a scurvy politician, seem to see things thou dost not.--King Lear
  8. idiots. by edrugtrader · · Score: 5, Funny

    5 posts so far, and 3 of them are of the "I WANT TO PARTICIPATE IN A SCO.COM DDOS" variety.

    people... that is illegal and not the way to win the fight.

    i'd say more, but i have to go load that virus on my 3 other laptops.

    --
    MARIJUANA, SHROOMS, X: ONLINE?! - E
    1. Re:idiots. by MikeXpop · · Score: 4, Funny
      ...that is illegal and not the way to win the fight...
      --
      WANT TO BUY ILLEGAL DRUGS ONLINE? - EDRUGTRADER.COM! [edrugtrader.com]
      Hmm....
      --
      Etiquette is etiquette. He kills his mother but he can't wear grey trousers.
    2. Re:idiots. by Smidge204 · · Score: 3, Funny

      Trying to DDoS SCO is illegal? What about what /. been doing nearly every day?

      Oops. I think I hear SCO lawyers slithering out back...
      =Smidge=

    3. Re:idiots. by CGP314 · · Score: 3, Funny

      people... that is illegal and not the way to win the fight.

      Tell that to SCO

      --
      In London? Need a Physics Tutor?

      American Weblog in London

  9. Looking for the virus writer by RY · · Score: 5, Funny

    To show that there are no hard feelings after the virus enterd my work network, I would like to invite the virus writer to play a game of baseball.

    Just show up, I'll brng the bat!!!!!!!

  10. Re:SCO is down by britneys+9th+husband · · Score: 5, Funny

    Looks like you've figured out how the ddos works. Put "www.sco.com" in the virus, get it mentioned on Slashdot, and the /. effect takes down the site.

    --
    Hear recorded Slashdot headlines on your phone! New service beta testing. Just call (248) 434-5508
  11. Re:Bad example... by BladeMelbourne · · Score: 4, Funny
    is this really the way to fight against SCO?

    Humour aside, if that was the intention of the virus, it should bring down the SCO email server (mail.sco.com) as well as www.sco.com. This would hurt sales and cause a major inconvenience.

    SCO's lawyers are probably 'creating' a lawsuit as we speak - claiming the portions of the virus are SCO IP. (Which is just as believable as Linux containing SCO's code.)

    SCO could also have written the virus - to hurt the image of their competition.

  12. Why? by Sycraft-fu · · Score: 3, Funny

    Does the virus install it's source, whine about the GPL and insist on being called GNU/MyDoom?

  13. Just thought I'd throw in a stray comment... by shaitand · · Score: 3, Funny

    I DO in fact have a paypal account and am willing to accept donations for my contributions to society.

    Send donations to:
    wenNOdoy@SPAMconsolidated.net

  14. Re:Also arrives as a zipped executable! by jfengel · · Score: 5, Funny

    First you save the attachment.

    Then you unzip it.

    Then you execute it.

    Why do the virus writers even bother writing code? If people are willing to do all that, it sounds like the next virus will consist solely of the text:

    "Pick a friend at random. Go over to his house and bash his computer with a sledge hammer."

  15. Re:Oh no by Progman3K · · Score: 4, Funny

    >Now Darl seems to have some credibility with the Linux == terrorism threat.

    No, he doesn't; it's a Windows virus, not a Linux virus.

    Windows == terrorism

    Proof that Windows is a danger to national and economic security.

    --
    I don't know the meaning of the word 'don't' - J
  16. the giveaway by tacokill · · Score: 4, Funny

    Alright. Now listen up. Here's the deal....and I'm not accusing anyone...I'm just saying...

    "The worm encrypts most of the strings in it's UPX-packed body with ROT13 method,"


    I *KNOW* it was one of you fuckers...

  17. How I imagine things by skinfitz · · Score: 5, Funny

    it can perform a denial-of-service against www.sco.com. Details at Symantec and F-Secure, although neither seems to have finished their analysis.

    Cut to the labs of the antivirus companies:

    Sir! The new virus seems to launch a DDoS against sco.com!

    REALLY? Great work! Now .. lets take our time over this.. no need to rush things now is there? I mean - we wouldn't want to make a mistake or anything now would we?

    Take a 2 day lunch.

  18. Re:Finally! ...now for a bit of help... by Dr.+GeneMachine · · Score: 3, Funny

    Yeah, I suggest removing all CD/DVD/Floppy and whatever drives and ripping the network cable out of the wall. Better yet, disconnect the power supply... Voila - secure system.

    --
    This comment does not exist.
  19. off-topic note by liquidsin · · Score: 3, Funny

    Google now shows Caldera as the first hit for a search on "litigious bastards", while www.litigiousbastards.com (a site about SCO) comes up about five down. Go team!

    --
    do not read this line twice.