Slashdot Mirror
Today's Windows Virus - MyDoom / Novarg
Oddster writes "There is a new virus out by the name of Novarg which can infect all Windows versions from 95 to XP. It has two interesting features - first, in addition to mass mailing, it also distributes itself via the P2P network Kazaa. Second, it can perform a denial-of-service against www.sco.com. Details at Symantec
and F-Secure, although neither seems to have finished their analysis." Other readers have sent in links to coverage at CNET and Security Response, and Russ Nelson provides a sample message.
Here's another story.
Funny that I come to submit the article and already find it at the top of the page...
Hi,
I believe ClamAV was the first virus scanner to pick it up and because they couldn't find any others that had picked it up and named it, they called it "Worm.SCO.A". Gotta like Open Source.
Oh, and I've blocked over 3000 copies of the worm in the last few hours with clamav.
Jib
Unlike some other *cough* commercial virus scanners. If you have your MTA setup properly with clamav (like qmail+qmail-scanner), a simple "freshclam --stdout" will do, then watch the "SCO.A" log messages scroll on by.
Nobody from here - we would have just done it with a perl script or some javascript embedded in an html emails' <body onload="melt_the_litigious_bastards_servers()"> tag. .... now let's see...
Hmmm
Who the hell is gonna open a 3kb executable from kazaa?
The same idiots who install it.
Kazaa is not secure. It installs spyware that monitors keyboard activity. If you type an email address on a PC that has Kazaa, that address will be spammed into oblivion. Webshots does the same thing. Not directly, but through one of many third party applications that are installed silently.
Life is the leading cause of death in America.
* ^ *Content-Disposition: attachment;
* filename=".*\.(pif|exe|scr|zip|bat|cmd)"
Looks like it works:
wee@foo:~$ grep 'mail/virus' .procmaillog | wc -l
21
Not terribly effcient, but every little bit helps.
-B
Ash and Hickory, straight-grained and true, make excellent bludgeons, dandy for the cudgeling of vegetarians.
"W32/MyDoom-A also drops a file named shimgapi.dll, which is a backdoor program loaded by the worm. The backdoor allows outsiders to connect to TCP port 3127 on your computer."
From www.sophos.com
Well, it allegedly opens a backdoor on port 3127, so I'd think you'd either want to not run it at all, or make sure you will be able to keep your firewall up until such time that you verify the virus is completely removed from your system.
Air-traffic control systems don't run no Linux. They either run QNX or SCO.
Linux in Air Traffic Control
All Hail Discordia. Hail Eris. Fnord.
* ^ *Content-Disposition: attachment;
* filename="(message|body|document|doc|data|readme|
Well I have my copy! Arrived in my fiancee's inbox this afternoon. She helped me analyze it in Linux over the phone. (She's a biblical scholar when she's not hacking. What's not to love? :) Well we ran strings on it, among other things: it contains a few nuggets:
/abcdU VWXYZ
;-)
o Part way down the strings output there the following:
(sync.c,v 0.1 2004
1/xx
: andy)
Weird.
sync.c: I believe is a linux kernel file? Maybe it was written on Linux? Who knows.
o Further down is:
notepad %s
Message
This is consistent with the notepad screenshot on McAfee.com
o Then some more weirdness:
ghijklm
pqrstNwxyzg
ABCDEFGHIJKLMNOPQRST
I guess this cracker knows the alphabet. I am impressed!
o More funniness:
Sack_i
smith[C
&joe?neo/
Matrix fan?
o gold-Pxc
I guess this is reference to the electronic banking system it attacks
o Further down:
USERPROFI
Going for the registry I see...
o More sequences
ASCII
r=it f
0aA!0123456789+
My guess is that the sequences are character food for the random message generator
o Towards the end:
Libra
I guess this hacker is indecisive
o Finally, it wraps up with a list of windows dlls and function names.
-ghostis
our comment violated the "postercomment" compression filter. Try less whitespace and/or less repetition. Comment aborted.our comment violated the "postercomment" compression filter. Try less whitespace and/or less repetition. Comment aborted. lameness filter food
Computer Science is all about trying to find the right wrench to bang in the right screw. -T.Cumbo?
"We're about the last people who would be out writing Windows viruses."
Try reading at -1 every once in a while.
The social engineering on this one isn't half bad.
.zip file was "readme.txt%20%20%20%2020%20%20%2020%20%20%20.scr" , which shows as "readme.txt" in the Windows GUI.
The first one I got looked like a bounce message, with text saying there were some non-7bit characters so the full message would be in an attachment.
The payload inside the
Believe it or not, there are mailers in the Windows world that send bounces with the original message as an attachment. This worm could easily fool someone who wasn't technical or wasn't paranoid.
The executable is way too small (22,528 bytes compressed vs. 150k+ for most of the usual trash by spammers). I certainly doubt it was written in VB.
One line blog. I hear that they're called Twitters now.
Actually, if you really want to know where you can get it, the virus deposits a text file, very cookie-like, in a Windows user's Temporary Internet Files folder that points to a site called http://russnelson.com which ostensibly belongs to a man who works for a software company in upstate New York. And if you really want to download that cookie (and potentially the .scr file), you can go to russnelson.com/mydoom.
I doubt you've got the virus. The virus has probably used your email address as the return address, so that you get the bounces despite not having the virus. I've received lots of virus warning bounces, mostly sent to "helen@benroe.com" and "serg@benroe.com", which aren't email addresses I use (obviously).