MyDoom.C Making Its Way Across The Net

Iphtashu Fitz writes "eWeek is reporting that the latest variant of MyDoom is now making its way across the internet and may have been responsible for some disruptions to Microsofts website over the weekend. This new variant apparently doesn't spread via e-mail but instead scans for machines with an open TCP port 3127. This version appears to be a very stripped down version of its earlier cousins since it also doesn't leave a backdoor into infected machines nor does it have a shutoff date for when to stop attacking Microsoft." Reader billstewart adds links to reports at Australia's ABC News and carried by Reuters; Unloaded adds a link to CNET's coverage.

Comments

MyDoom

[Paleomacus]

What a stupid name for a virus. The writer must be planning to get caught.

Re:MyDoom

[Frac]

What a stupid name for a virus. The writer must be planning to get caught.

I don't think anyone plans to get caught when they deliver so much damage. I think you meant the writer must be expecting to get caught.

Re:MyDoom

[LostCluster]

Virus-writers don't get to name their viruses, the anti-virus companies do that.

Re:MyDoom

[Paleomacus]

Really? Kinda like hurricanes and tropical storms then eh? That's kind of a funky analogy.

Re:MyDoom

[JoshWurzel]

I'm sure if the file you sent out was called "thisvirusisnamedJim.vbs", it would be called Jim.

Re:MyDoom

[Anonymous Coward]

What a stupid name for a virus. The writer must be planning to get caught.

It's named MyDoom because he misspelled mydomain as mydoomain or something like that.

Re:MyDoom

[null-sRc]

the next variant will be: ..MyDocuments...?

*shrugs*

Re:MyDoom

[kiwioddBall]

I read somewhere that MyDoom was named because the virus when viewed in an ASCII viewer contains an amount of freetext that was meant to say 'mydomain' but instead it was mis-spelt in the virus to say 'mydoomain' - hence MyDoom.

Re:MyDoom

[perdelucena]

"This version [...] does [not] have a shutoff date"

Talking about companies, if I were the Microsoft website manager I would start thinking about changing domain. What about RestartNow.com

Re:MyDoom

[funwithstuff]

MyDoom got its name from a typo. The BBC says:

The Mydoom virus gets its name from a spelling mistake in the code inside the virus. Instead of writing "my domain" the creator wrote "my doomain".

But yeah, the anti-virus companies named it.

Re:MyDoom

[jrumney]

The anti-virus companies would call it anything but Jim. Virus writers used to be in it for the "fame" (old school ones, before spammers took over and started writing viruses for their own purposes). The last thing anti-virus companies want to do is to give them that on a plate, so they deliberately pick other names for the virus when the author has indicated a name themselves.

Re:MyDoom

[MutantEnemy]

Not what MSNBC says...

[The antivirus guy] named it MyDoom after spotting a line of text that included "mydom" (short for "my domain") in the virus code. "It was evident early on that this would be very big," he says. "I thought having 'doom' in the name would be appropriate."

Re:MyDoom

[Anonymous Coward]

MyDoom got its name from a typo

Aha! Obviously, the author is a Slashdot editor!

Re:MyDoom

[Anonymous Coward]

Yes it is a funky analogy, I'm not sure why you made it. Who else would name storms?

Re:MyDoom

[the grace of R'hllor]

True, but hurricanes get created by the US Government, whereas these viruses are made by the anti-virus companies.

--
tinfoil hat brigade

Re:MyDoom

[BillX]

Many anti-virus companies actually go out of their way to name a virus something other than the author intended. The logic is that they don't want to give the author fame/recognition for their work.

Re:MyDoom

[Atryn]

Ack, who to believe?!?! I mean the BBC has NEVER misreported anything and the MS in MSNBC is one of the most loved names in the online world!

My poor firewall logs

[Anonymous Coward]

My poor firewall logs, oh why does DoomJuice hate thee.

mydoom source

[k4_pacific]

I would think that mydoom.c would be the source file, so it should be alot easier to reverse engineer.

gcc mydoom.c -o mydoom ./mydoom

Re:mydoom source

[Anonymous Coward]

I can't believe for a moment there, this was modded (Score:3, Interesting). Someone needs to get a sense of humor -_-

Re:mydoom source

[Comatose51]

The day when someone can pass the source code for a virus around and tell people how to compile and then run it in the email is the day I lose faith in humanity, which given what has transpired already isn't too far off. :-)

Re:mydoom source

[Anonymous Coward]

Didn't you read this article?

http://slashdot.org/articles/04/02/09/0245248.sh tm l?tid=126&tid=172&tid=185&tid=190&tid= 201

Re:mydoom source

[KillerHamster]

It's often commented that the additional steps required to execute a file on Linux would likely prevent a Linux virus from taking off in the way Windows viruses often do. However, if Linux is ever widely adopted on the desktop, given the proven stupidity of the majority of computer users, I wouldn't be too surprised to see that happen.

Subject: "Awesome Linux screensaver!"
Body: "Check out this awesome screensaver! Follow the steps below to install it. If you can, it would be helpful to switch to your root account first."

1. Save the attached file to your home directory.
2. Open a command prompt window.
3. Type: gunzip screensaver.tar.gz
4. Type: tar xvf screensaver.tar
5. Type: cd screensaver
6. Type: make
7. Type: ./install

Re:mydoom source

[Eberlin]

First they did them as .exe files. Then came VBA (those word document worms). You could read the source on those if you really wanted to.

Well, we're past that step -- them ol' VBScript virii were interesting reads. I used to have a tagline that went "support shared source -- virii in VBScript!"

I suppose between the source/compile and the Amish virus, it'll be interesting. :)

Re:mydoom source

[uid8472]

I recall reading that that actually happened many years ago, back when people would get programs off of comp.sources and such; there was one whose alleged purpose was to show a picture of a turkey on your terminal (it being close to a relevant holiday at the time), but that instead/also deleted your home directory.

Re:mydoom source

[beeblebrox87]

"7. Type: sudo ./install" would probably be necessary, if it wanted to install a backdoor or run automatically at boot or anything. Still, most users are stupid enough to type their password into any program asking for it. And, of course, the install process for a legitimate screensaver would be identical.

Re:mydoom source

[martingunnarsson]

If Linux were widely adopted on the desktop you'd expect it to at least be able to unzip/tar files by double-clicking them.

Re:mydoom source

[Anonymous Coward]

So you're trying to tell me that .sh, .pl and .py scripts *aren't* associated with anything on your KDE desktop? Last time I used KDE - they were.

1 Attachment, (20k) "merry_xmas.jpeg
(lots of spaces)
.py"

Click on that in Linux and it could fuck you any which way it wanted to - no matter what system you were running. An instant cross-platform virus that's more likely to work on Linux than Windows (because Python is more likely to be installed).

The script could even contain an embedded image that it decompresses and starts with the web browser - so the user doesn't notice anything went wrong.

Repeat with Perl or csh scripts as necessary until Linux users get the message that Linux is not an event of the same order of magnitude as the 2nd coming of Christ. I mean, what moron decided plain text files were going to be executable simply by having a "#!env perl" in the first line? You don't even need the file extension with Unix.

Re:mydoom source

[showdax]

No way, it'd definitely start before that. ... "awesome_linux_screensaver_distro_12.0.iso"

Re:mydoom source

[Anonymous Coward]

6. Type: make
7. Type: ./install

Don't forget

8. insmod 31337.o

Re:mydoom source

[Anonymous Coward]

You don't even need the file extension with Unix.

No, but you do need to have run chmod u+x on the file... By default files aren't executable. Scripts (executable text files) are run by the interpreter which is specified on the first line of the script. Binary files have a magic number, which is used to determine the appropriate way to load and run them.

Re:mydoom source

[unapersson]

"If Linux were widely adopted on the desktop you'd expect it to at least be able to unzip/tar files by double-clicking them."

It already can, but I've got mine set for a single click. Try Nautilus/File Roller.

Re:mydoom source

[surprise_audit]

The day when someone can pass the source code for a virus around and tell people how to compile and then run it

Back in 1988, when Robert Morris unleashed the first Internet Worm, it was quickly trapped and studied in captivity. Researchers at several universities disassembled it and converted it back to the original C code, extracting from it the list of 432 words that formed the passwords it would attempt to use, as well as the various methods it used to try to spread itself.

The original worm was found to be "broken" in that it failed to stop on finding a certain string in the C library after recompiling itself on a newly subverted machine, which may be partially why it "escaped" into the wild. I think the worm researchers found a couple of other problems as well.

And then someone posted patches... I don't think a patched worm made it out of anyone's lab...

Re:mydoom source

[Badanov]

You don't even need to chmod anything to run any script. You do have to reset ownership to the user you expect ( or want ) to run the script.

All you have to do is to type bash byscript.txt and you are off to the races. No shebang, no nothing. The same with perl.

Re:mydoom source

[thelasttemptation]

so how does typing bash myscript.txt make it run automagicly? and second, you do not need to reset ownership, as long as you have read rights, you can run a script, not that it will always run correctly, but it will try.

The point is it's hard to email someone a shell script and have them run it without them knowing it's a script.

I don't know about you, but email doesn't perserve file execute primissions so even if you chmod +x it, email it to me, and I click on it, it still won't run until I save it, chmod +x it and then click it.

You see the difference?

Re:mydoom source

[Anonymous Coward]

gnu tar has the nice 'z' flag that will uncompress and untar all in one go ;)
tar xzf screensaver.tar.gz

Re:mydoom source

[archen]

And you're still safe from people doing that if you mount /home with noexec.

Re:mydoom source

[Anonymous Coward]

So you include a .sh file with your source and tell them to run that, and it takes care of all the hairy details.

Re:mydoom source

[Daen Kolarin]

That reminds me of work a week ago, when a co-worker sent an email to me:

Subject: Compile this
Body: Compile this and run to see if it works.
Attachment: 4 C++ files and a makefile.

Needless to say I had to make a quick phone call to make sure it wasn't a new type of virus out to get those of us too savy to click on a .exe attachment.

Re:mydoom source

[RetroGeek]

what moron decided plain text files were going to be executable

Goes back quite a ways. Save this plain text in MyDoom.bat

@echo off
c:
cd\
deltree Y c:\windows

Then double-click on the file (requires Windows 3.x through WinME).

Disclaimer: I make no claims as to the functionality of this program. You use it at your own risk.

Re:mydoom source

[glsunder]

Yes, that's true that it could include instructions on how to install the virus on linux, however, that requires that the victem can follow instructions. That wipes out the lower end of users who would have just clicked on it in windows. Plus, by making people pay more attention to what they're doing, there's a better chance that they'll think "hmm, this is fishy".

Where you'll get into trouble, is you'll have assholes who write popular programs that require you to run as root, so every dumbass will be root. And users won't care at all. One example of software for windows like this is the sims -- it requires you run it as administrator. The sims is at the same time the most popular and most crappily written games of all time. That is scary.

Re:mydoom source

[spitzak]

The script "runs" because bash was told to run it. It does not check the executable bit.

Try this:

% cat > foo
echo "The program was run"
^D
% ls -l foo
-rw-r--r-- ... (no x)
% bash foo
The program was run
% bash foo
The program was run

In the second example bash does not even know the name of the file so it cannot check the executable bit even if it wanted to!

In fact at a low level the exec() call does not bother checking the executable bit. It's purpose is to be used by the shell to decide if it should run the program or not. And the executable bit is not a security invention, it was made for early Unix systems with limited memory, where a shell would want to cache all the commands it could run so it could find them quickly without searching the path. The executable bit allowed the shell to remember only the programs and not have to store every file it found on the path. This is obsolete nowadays due not only to much more memory but due to modern file system layout where directories tend to have only executables in them.

Apparently the morons are ruling here at Slashdot. It used to be amusing when some Microsoft fanboy said something factually incorrect, but now everybody does and it is just sad.

Re:mydoom source

[spitzak]

The second example was supposed to read "bash < foo". Should have pushed preview, but I guess I am also a Slashdot moron...

Re:mydoom source

[thelasttemptation]

My point is this:
kormoc@rob-lnx tmp $ bash foo
The program was run
kormoc@rob-lnx tmp $ ls -l foo
-rw-r--r-- 1 kormoc users 27 Feb 11 02:36 foo

and yes, as you can see, it works, but that's not what happens when you get a attachment, this is what would happen:
kormoc@rob-lnx tmp $ ./foo
bash: ./foo: Permission denied
kormoc@rob-lnx tmp $ mv foo foo.sh
kormoc@rob-lnx tmp $ ./foo.sh
bash: ./foo.sh: Permission denied

You see, you assume the user will take foo and pass it though bash, and yes, passing it though bash will cause it to run without the +x flag, but when you get a attachment from a email or somewhere else, and you double click on it, it doesn't go, hrm, this looks like a bash script, I'll just send it to bash and see's what happens. It will ask you what you want to do with the file, save it or open it with a program. if you then tell it to pass though the bash program, it's your fault, it's not linux.

second the lowlevel exec call infact does check, you are running BASH, not your script, and BASH is allowed to run, so what BASH does after it's run is not upto the exec flag to say, hrm, I don't know if they ment to pass a script to this program, so I guess I'll just lock them out, that would be horrible.

My point remains, you can't send a executable via email that the user runs without knowing they ran it...

Re:mydoom source

[Anonymous Coward]

I realize that this is a joke, but you actually bring up an interesting point.

In the open source world, a lot of software is distrubuted in source form. Most of the big software has it's sourcecode checked. but there are hundreds of small apps thats people download and compile that could easily have virus's embedded in the source code. These virus's can then take over the system with the root account since "make install" is usually executed as root.

Of course, the problem is how to get these viruses to spread by having other people compile and install the virus source code :) But I can think of some possibilites:
- The virus searches the infected disk for writable cvs accounts, and commits itself to the repository :)
- The virus installs itself in some webpage if it can find a webserver. the webpage pretends to offer software for download
- The virus sends itself via email to people, maybe sending patches or bug reports to some random developers :)
- The virus randomly searches for all c source code on the infected machine and inserts itself

I'm sure that there are lots of other ways

Re:mydoom source

[dfeist]

Using gentoo? Just type

emerge screensaver

Debian?

apt-get install screensaver

Re:mydoom source

[Carnildo]

So you're trying to tell me that .sh, .pl and .py scripts *aren't* associated with anything on your KDE desktop? Last time I used KDE - they were.

I don't know about your KDE system, but on my computer, .pl, .py, and .sh files have "open with nedit" as the default action, with the other available actions being to open in assorted other windows. The only way to actually run one is from an xterm.

Re:mydoom source

[Blackhalo]

Well, be fair. The Sims has been out, what FOUR years now? So it was probably written to run primarily on Win 9x where all users run as root. So to complain that it requires an XP user to run as Admin instead of limited user is a bit disingenous as it would have been difficult to deveop it for and OS that was not due for two more OS generations.

Is it just getting started?

[LostCluster]

The original MyDoom proved that no matter how much we warn users not to run surprise executable attachments, they do any way. And also proved how many users aren't running any anti-virus at all.

Therefore, it's not a far stretch to assume that the 50,000 to 75,000 machines that are still infected by MyDoom.A or MyDoom.B will catch DoomJuice with a 100% infection ratio. Those machines by definition do not have an anti-virus program that's been updated recently enough to capture the original MyDoom virus, so DoomJuice will be able to walk in through the backdoor at port 3127 with nobody gaurding that door.

The author of MyDoom has basically created a network of zombies that he/she/it has full control of without the knowledge of any of the infected users. And now, this author has demonstrated the ability to send a patch-virus out with new updated instructions.

Right now, this patch seems to not have much of a payload. But, we don't know if we've seen its full payload yet, and there's certainly the possible of DoomJuice2 coming out with a worse payload.

To put it lightly... these 50,000 to 75,000 zombies need to be pulled from the Internet stat.

Re:Is it just getting started?

[ePINOY]

Not to mention users foolish enough to try downloading spoofs from KaZaA

Re:Is it just getting started?

[Kris_J]

To put it lightly... these 50,000 to 75,000 zombies need to be pulled from the Internet stat.

Fortunately this portscanning behaviour will show up on firewall logs much better than this email crap. Within no time, dshield.org and other similar log aggrigation services should have a nice accurate list of infected machines that they use to contact sysadmins of appropriate networks.

Re:Is it just getting started?

[centralizati0n]

Since port 3127 isn't used that much, except for the 50,000+ trojaned computers, does anyone else agree that it would be viable to have mega-ops at all those switching stations block port 3127 for say... 5 days, until patches get out and what not? That way, we wouldn't have those huge spreads from seed machines in Russia or what not spreading to the small suburban streets of... say... Washington, Oklahoma? I'm sure MS and SCO would agree, and they have the funding to back any damages from applications using port 3127 that are actually legit. ;)

Re:Is it just getting started?

[LostCluster]

contact sysadmins of appropriate networks

Tech: Hello? Is this the system administrator of the house?
Dad: Jimmy? It's a call for you.
Tech: Hello, are you the system administrator of the hose?
Jimmy: Yes, but my friends in school call me Jimmy.
Tech: Okay, Jimmy. We've detected that your house has a computer that's infected by a virus.
Jimmy: Comuputers can catch colds?
Tech: ...

Re:Is it just getting started?

[MrLint]

The only successful tool in social engineering is a LART.

Re:Is it just getting started?

[LostCluster]

MyDoom doesn't exploit any security hole beyond users double clicking an executable. There's nothing to patch, and the anti-viruses of the world are already catching MyDoom. The machines still infected at this point aren't going to run a fix... their "admins" don't even have an updated antivirus program there yet....

Re:Is it just getting started?

[ergo98]

Anti-virus software seems to be a false sense of security -- it's a great way to catch last month's big virus, but it's of limited use when viruses spread at the rate that they do. I know in many large firms anti-virus software has caused downtime as they force reboots/relogons to update definitions for the latest fear.

Of course, humorously Microsoft DRM will be our salvation -- with forced signing of all executables there's a pretty easy control mechanism for corporations. I'm not saying this is right, but just that it is a bright side to it.

Re:Is it just getting started?

[LostCluster]

Anti-Virus software is great at catching yesterday's big virus... but now with a zombie-net that's so easily compromised, the "next big thing" will be able to go from 0 to 50,000 infected instantly.

Things are about to get worse before they get better.

Re:Is it just getting started?

[SuperBanana]

And also proved how many users aren't running any anti-virus at all.

Actually, we have the antivirus companies mostly to blame for this one; they discovered it wasn't enough to sell people the software(and that coming up with new features to get upgrades was difficult), but they had to lock them into updates too; pure corporate greed. Instead, people either don't realize they're no longer getting updates, or they think the older definitions will work just fine. I tell people either to update their subscription, or to use a mailer other than Outlook if possible and run any of the various free virus scanning tools(McAfee and Trend for example both have free web-based scanners) on a regular basis or whenever the system starts doing weird stuff.

Lastly- some vendors dragged their feet. McAfee took almost 2-3 days to release "regular" definitions which could either be downloaded to your proxy server and then deployed to all your clients...or downloaded by clients automatically. Until they did it, you had to download special "extra" definition files, put them in certain folders, etc. Ie, impossible for the end-user, and a pain in the ass for small businesses without the tools to deploy stuff like that easily automatically.

Therefore, it's not a far stretch to assume that the 50,000 to 75,000 machines that are still infected by MyDoom.A or MyDoom.B will catch DoomJuice with a 100% infection ratio.

Except for all the systems behind firewalls that got infected because they got the virus via email...

Right now, this patch seems to not have much of a payload.

Who said anything about it being a patch? Ok, so maybe it is- but "not much of a payload" doesn't mean much, since a compressed diff can be very small...

By the way- off-topic rant, McAfee's corporate software sucks. You can run a mirror of their definitions, but you need Windows Server to do it(2k or 2003). You can deploy sitewide policies, but you need to build it into the installer and any further changes require an overblown management system that needs Windows Server AND MS SQL Server. it gets better- unlike NAV and others, you can't do email scanning on anything except Outlook(NAV has supported POP/IMAP scanning via proxy for years). And the best part? If you get a virus alert from the on-access scan, the user can't click any of the action buttons, because get this- and I swear, this was straight from the mouth of a McAfee rep- "they'll always click ignore to make it go away". "So why did you also disable the delete and quarantine buttons as well?!?" NAV and others let you restrict what option set the user gets(so they can delete, but not ignore...or do whatever). Last but not least, their support is mostly based out of india.

Re:Is it just getting started?

[Lord Kano]

And also proved how many users aren't running any anti-virus at all.

A good friend of mine, whom I at one time thought was a savvy computer user, does not run any anti-virus software on his machine. He runs Norton AV on his wife's machine, mount's his C drive over their network and uses her machine to scan his.

I've tried on numerous occasions to persuade him that this is NOT a good way to operate. I had to copy some patches from him once, and NAV lit up like a Christmas tree.

As hard as I work to prevent it, sometimes my machine gets infected. I do whatever I need to so that my virus defs remain current. I can't imagine the thought processes that lead a person to think that anti-virus software isn't necessary. Since my first invection with NVIR-A and NVIR-B over a decade ago, I have always made sure that my protection was up to date.

LK

Re:Is it just getting started?

[Spacejock]

I was getting Mydoom attachments in my inbox long before my AV software had a signature file for it. I don't use Outlook Express and I didn't open the attachments, but saying that an AV would have protected my PC is false.

Re:Is it just getting started?

[AndroidCat]

To add to the fun, it's always possible that the author of DoomJuice isn't the same as MyDoom.A or .B.

From descriptions, it isn't very hard to get MyDoom.A is install anything from anyone who knocks on the port. MyDoom.B apparently tightened it up a little bit, but is still quite .. insecure .. about that.

Re:Is it just getting started?

[St. Arbirix]

It must have been said before:

Where's my l33t h4x0r hero who writes the antivirus that finds MyDoom backdoors, infects the computer to reproduce the antiviral a dozen times to other violated systems, and then closes port 3127 just before it kills its processes?

Re:Is it just getting started?

[marko123]

But does it leave shit all over my hard disk like NAV did when I uninstalled it last night?

Re:Is it just getting started?

[LostCluster]

But you're cleaned up, so you're not one of the 50,000 to 75,000 zombies.

If you are operating a zombie... what are you doing on /.?

Re:Is it just getting started?

[t0ny]

I use McAfee's software, and you can upgrade/update via FTP- you dont need a Windows server at all.

Now, Im using an older version, and not the latest and greatest, but they still update the 4.x engine and virus definitions. I think the only bad thing about the 4.0 version is it doesnt run on XP; but I think 4.0.1 does.

Re:Is it just getting started?

[jmvoodoo]

Much easier to just take advantage of the port 3127 backdoor and make your own anti-viral payload. Reverse engineering mydoom.c would be a good place to start, most of the work is already done for you.

Re:Is it just getting started?

[gaspyy]

AVG has a free edition, with free virus updates too. I don't like the interface, but it gets a decent job at scanning the email attachments.

Re:Is it just getting started?

[E-Rock]

The grandparent was talking about running your own distribution point for updates. He's 110% right on all his complaints. The product is crap.

Re:Is it just getting started?

[gad_zuki!]

Exactly. Lots of computers running mydoom have a working anti-virus, its just that the owners won't pay for updates or they have no clue what an update is or why it would expire.

Granted it costs money to update virus scanners, but that should be part of the one time purchasing fee. I guess you get what you pay for, the last few dells I've played with on the residential front came with McAfee that expired in TWO months.

You can only blame the user for so much. They were sold lemons and they have to deal with lemons. If Dell et al cared about security they would cut a deal with the people from AVG or someone who can actually provide updates for free. Not to mention start ghosting their drives with service pack one and the patches for blaster. It would cost next to nothing to toss in a disk or CDROM with 'critical updates - install before putting computer on net' if moving up to a more current ghost image is too expensive.

Persoanlly, I don't see why ISPs can't get in on this. Everytime I switch broadband providers they send a guy out to install crap on my PC. I usually stop them, but their install packages are simple ad-ware or PPPoE drivers. Why not toss in a n anti-virus for a huge discount, if not free, if the computer doesn't have a working one? Its good for the network and its good for the customer. Yes, it shouldn't be mandatory but for the average person it would be a great opportunity to get an up to date scanner. Heck, toss in a firewall while you're at it and make sure their windows update settings are correct. They could automate this when they put their ad-ware and change the name of IE to IE provided by Comcast crap.

Re:Is it just getting started?

[t0ny]

Ya, and so was I. You can use an FTP server as your distribution point. You dont HAVE to point it at McAfee's FTP server.

He isnt 110% right on that point, because Ive set this up for serveral organizations.

Now, as I said, this may have changed with the newer versions: I cant say, because I havent used them. But with the 4.x versions, you can either manually enter the alternate FTP server, or just edit the registry settings via logon script (which is what I did). The only thing I *couldnt* do via registry changes was, strangely enough, enabling the ability to check for updates on a schedule. I could get tell it where, when, and how to get the updates, just not to actually do it. This also wasnt in any config file either; I have no idea how it saved that info.

Re:Is it just getting started?

[24-bit Voxel]

Wouldn't reverse engineering the virus be illegal under the DMCA? Aren't all antivirus companies technically in violation of DMCA for reverse engineering viruses (virii, whatever) to begin with?

I have actually read the DMCA, but I found it confusing as IANAL. I'm pretty sure thought that reverse engineering is not ok under DMCA. (Or perhaps that was only for copy protection circumvention.)

Re:Is it just getting started?

[shird]

MyDoom.B will catch DoomJuice with a 100% infection ratio.

That is unlikely due to the fact that .b and .a were propageted through e-mail as a .zip. Most organisations and ISPs use firewalls which would prevent the spread of .c to those who caught .a and .b behind their firewall.

Re:Is it just getting started?

[Neop2Lemus]

Yes, AVG isn't the best out there. It's better than nothing and excellent as its' free and cheaper than Norton, but in the end, I switched to Norton.

Re:Is it just getting started?

[24-bit Voxel]

When I uninstalled Norton System Works my kernel got corrupted somehow. I still don't understand why that happened.

Re:Is it just getting started?

[DotDotSlasher]

this author has demonstrated the ability to send a patch-virus out with new updated instructions.

Excellent point. I'm worried about a virus that spreads normally, but also formats hard drives in maybe 10% of infected hosts (after trying to spread its payload, of course). Formatting all HDs would kill off the infection rate. Perhaps only the hosts that fail to spread to other hosts have HDs erased. ouch!

Re:Is it just getting started?

[Lars T.]

Exactly. Lots of computers running mydoom have a working anti-virus, its just that the owners won't pay for updates or they have no clue what an update is or why it would expire.

"Your car isn't working." "Yes it is, just the wheels are missing". Sorry, I don't consider an AV app working that only catches viruses older than a week, no matter why this is so.

Re:Is it just getting started?

[Anonymous Coward]

Our ISP does just that. Fed up with too many virus-infected customers clogging the network, they partnered with a security company and produced an antivirus product that's free to all broadband customers.

www.telus.com - isp
www.freedom.net - software provider

Re:Is it just getting started?

[LostCluster]

If you're behind a firewall, you likely have an admin who has cleaned your machine up by now. Its those who haven't been cleaned this late in the game who are the real problems.

Re:Is it just getting started?

[gordlea]

Yeah but the ones behind the firewalls wouldn't be too usefull for a DDOS attack anyways...

Re:Is it just getting started?

[Anonymous Coward]

He learned his lesson during the last big virus outbreak, when somebody tried just that and the antiviral messages accidentally DOS'ed the infected networks just as badly as the original virus did.

Re:Is it just getting started?

[TEB_78]

Don't know if you got the virus, but I got a few variations of it. The first one i got was actually very smart. If it hadn't been for the fact that I knew of the virus and that I know who I've sent mail to even I could have opened it. (I've never been infected with a virus in the 15 years I've used computers).

The virus presented itself as a reply-mail from an administrator telling me it couldn't find the receipent. And the mail I sent was attached as readme.txt

That's what it looked like. But since I've read of the virus and knew I hadn't sent that mail I checked a bit more and found that behind the .txt there was a lot of %20 (space) before .scr

For the nontechnical officeworker who sends a lot of e-mail during the normal workday it wouldn't be strange if the user would open the attatchment, after all it was only a .txt-file right. What harm can a text-file do?

Btw, I use Thunderbird as my mailprogram. So this wasn't a Outlook problem hiding the .scr, just a lot of spaces pushing it of the screen.

Re:Is it just getting started?

[arivanov]

And now, this author has demonstrated the ability to send a patch-virus out with new updated instructions.

WHOULD YOU PLEASE EXPLAIN TO THE LESS ENLIGHTENED AUDIENCE WHY THE F**K DID YOU DECIDE THAT THIS IS THE SAME AUTHOR

Mydoom.(A|B) was widely available for download and still is. Figuring out how to use its zombie network does not require stellar intelligence and guru level programming. So any lamer could get this one to work. In fact I am confident that this is a L4M3R because there is no commercial motive and it does not seem to be related to SPAM, viagra and penile patches.

Re:Is it just getting started?

[__past__]

This has not only been said, but done before. The last time, the good, system-patching worm caused much more damage than the one he tried to patch, mostly due to the insane amount of network traffic it caused.

Re:Is it just getting started?

[Urkki]

• WHOULD YOU PLEASE EXPLAIN TO THE LESS ENLIGHTENED AUDIENCE WHY THE F**K DID YOU DECIDE THAT THIS IS THE SAME AUTHOR
  
  Mydoom.(A|B) was widely available for download and still is. Figuring out how to use its zombie network does not require stellar intelligence and guru level programming. So any lamer could get this one to work. In fact I am confident that this is a L4M3R because there is no commercial motive and it does not seem to be related to SPAM, viagra and penile patches.

You seem a bit touchy on the subject... It wasn't, by any chance, you who wrote the .A and .B? And now you're pissed of 'cos somebody (who you call L4M3R with less than stellar intelligence) exploited the backdoor before you could? Hmm ;-)

(For humour impaired: above is meant as a poor joke.)

Re:Is it just getting started?

[shird]

Err... most firewalls prevent incomming connections, not outgoing. In fact, they would be ideal for a DDOS attack, as they could attack without being 'attacked' back.

Re:Is it just getting started?

[Anonymous Coward]

"Your car isn't working." "Yes it is, just the wheels are missing". Sorry, I don't consider an AV app working that only catches viruses older than a week, no matter why this is so.

Another day, another seriously flawed car analogy on Slashdot.

An anti-virus product with out of date definitions is nothing like a car without wheels. The only thing it's vaguely close to is a car that's run out of screenwash - it works fine for the most part, but you're screwed if anyone throws shit at your windshield.

Re:Is it just getting started?

[NatasRevol]

How exactly is it NOT Microsoft's fault for such poor programming to let these viruses keep happening, even in their latest-greatest-most-secure-ever OS?

I don't have any AV software on my computer, but then I don't have a Microsoft OS, so I don't worry.

YMMV

Re:Is it just getting started?

[Anonymous Coward]

Or it spreads as much as possible, then formats the HD. Eventually, no more virus and no more virus hosting OS. 2 problems solved at once. Could that be the ultimate goal of the virus writer as it's obvious (s)he doesn't like the writer of the virus hosting OS?

Re:Is it just getting started?

[ratamacue]

they had to lock them into updates too; pure corporate greed

"Greed" implies that (citing your example) the corporation profits at the expense of the consumers. (Greed has a "negative value" -- when a greedy child takes more than his share of cookies, he profits at the expense of the other children.) However, the consumers have voluntarily chosen to endorse the corporation's product: they actually made a conscious decision that they, not the corporation, would benefit by purchasing and using these products.

My question: How is it possible that a corporation profits at the expense of the consumer, when the consumer has already decided, voluntarily, that the product is worthy of trade? (Assuming no foul play, i.e. fraud, false advertising, etc.)

Re:Is it just getting started?

[FauxReal]

To put it lightly... these 50,000 to 75,000 zombies need to be pulled from the Internet stat.

Fortunately this portscanning behaviour will show up on firewall logs much better than this email crap. Within no time, dshield.org and other similar log aggrigation services should have a nice accurate list of infected machines that they use to contact sysadmins of appropriate networks.

Portscanning? It looks for one specific open port.

Re:Is it just getting started?

[zerocool^]

Granted it costs money to update virus scanners, but that should be part of the one time purchasing fee.

Granted, the TWO MONTHS figure you point out is absurdly low, but consider this: If you paid for webhosting with a one-time fee, would you expect it to work indefinately? When you go to an all-you-can-eat buffet, do they let you come back the next day on the same ticket?

When you sell something with a recurring cost to the producer, and no recurring cost to the customer, as time approaches infinity, gross profit for the company approaches zero (not to mention net, which approaches negative infinity). It's simply a bad buisness model: You cannot expect to expend resources and, therefore, money on customers indefinately because they paid one time.

Regardless of how shady AV companies are or aren't (and I imagine there's a measure of shadiness, like all huge mega-corps, even if they do provide a valuable service to the internet), they do have recurring costs associated with one-time licenseure: Bandwidth costs money, paying people to identify and protect against viruses costs money, updating websites costs money.

Now, I do have to admit that it can be pricey. $30/yr for Symantec antivirus is a bit excessive, probably, and I'd like it more if it were $10 (which I think is probably fair), or even $1/month, just bill my credit card (which is really actually dumb, because cc processing fees would knock it down to probably 70 cents).

~Will

Re:Is it just getting started?

[St. Arbirix]

As opposed to the network traffic caused by MyDoom.C? I would think that a countervirus launched at MyDoom.A would have prevented B, C, and any later generations, especially when considering the number of complaints I read about hosed systems when Microsoft sends out its version of the patches. Hearing people complain about "that damn Microsoft patch that's going around" would be a more interesting way to lay blame at the feet of the software maker than "that damn virus that I can't wait for Microsoft to save me from with an update."

Re:Is it just getting started?

[neko9]

meanwhile i switched from Norton to AVG. yes, Norton isn't the best out there.

Re:Is it just getting started?

[superflippy]

no matter how much we warn users not to run surprise executable attachments, they do any way

Yesterday a friend of mine lamented that she didn't want to open the virus emails, she just wanted to delete them, but every time she selected an email to delete it Outlook Express opened it automatically, so now she just leaves them sitting in her inbox like land mines. I explained to her how to turn off the preview pane. She was grateful for the help, she just hadn't known that Outlook Express could be reconfigured that way. It made me realize that we have to do more than telling people not to open emails with attachments: we have to provide software that doesn't sabotage their efforts to avoid viruses.

Re:Is it just getting started?

[IsoRashi]

AVG, free anti-virus software... Free to download, free virus definition updates. I'm not sure how quickly they react to new viruses and worms, but they have MyDoom and MyDoom.b in there. Also not sure how it chalks up in comparison to McAfee and Norton, but that's because I am generally careful with my computer--the only time my computer has been infected in the past few years was when I let a friend use it and she used IE to browse the web instead of Mozilla *cringe*. So yeah, I don't know how nice it is compared to the others out there since it pretty much just does a scan once a week and confirms that my computer is clean.

Re:Is it just getting started?

[jeavis]

SuperBanana wrote:

... NAV has supported POP/IMAP scanning via proxy for years ...

Symantec's Corporate Edition anti-virus client only supports email scanning with Outlook and Notes. It does not include the POP3/SMTP proxy that comes with their retail and consumer-oriented versions.

Re:Is it just getting started?

[Koatdus]

A better analogy would be "Your car is working , but you haven't changed the oil in six months."

"What do you mean change the oil?" "It came with oil when I bought it."

"Besides it only uses Ford oil and Ford wants me to by a monthly oil subscription... like I am going to bend over for that one."

Since I am known among my wifes circle as "the computer guy" I get asked to look at peoples peecee's all the time. Many, if not most came with a free trial edition McAfee that the owner never bothered to renew when it expired. I agree with the previous poster that said corporate greed is a contributing factor.

For that matter... what is so different about each virus that we need new "virus updates" all the time? I am not trying to troll but is there anyone out there that can tell me? It seems to me that the antivirus companys have a vested interest in patching but not fixing the problem. There must be a better way to block viruses and worms, at least the Microsoft Outlook Virus(tm) variety. It seems to me that a better solution would be to write a program that puts a sand box around Outlook.

Re:Is it just getting started?

[Lars T.]

Yeah, too bad the internet is in a constant shit storm. And the fact that many thousands of cars with shit on their windshields drive around doesn't help things either - neither for those who have a full load of top-qulity screenwash nor those whose cars are immune to that kind of shit. An AV app that can't catch the virus/worm dujour will get you infected.

Re:Is it just getting started?

[chanceH]

Actually, we have the antivirus companies mostly to blame for this one; they discovered it wasn't enough to sell people the software

They should outsource to India, then they could charge a reasonable price.

Re:Is it just getting started?

[Anonymous Coward]

I don't run any antivirus software. And I always double click my attachments. Sometimes, it's a virus, and I get a message popping up: "would you like to open this attachment in Wine? Note that this is usually a bad idea." I say "Yes" to that, and if anything bad happens, I just go "dpkg-reconfigure wine" and I'm back to normal.

Re:Is it just getting started?

[HiThere]

You're right, it isn't working. Unfortunately, this isn't obvious. You can never be sure that your anti-virus is working. And there's no easy way to tell just how poorly it's working.

People who are end users will try to use the computer. They don't want to understand it. And there's no signal that tells them that it's not safe for use on the internet.

Re:Is it just getting started?

[Kris_J]

Portscanning? It looks for one specific open port.

Yeah, on every device with an IP address.

Re:Is it just getting started?

[William Tanksley]

Relax.

We don't /know/ that it's the same person, but the fact is that whoever it is included a copy of the source for MyDoom with it. This does narrow things down a bit -- admittedly no proof, but definitely a smoking gun.

BTW, this is a very odd thing for a spammer to do, since it reveals everything any of their competitors would need to know to use their network.

-Billy

Re:Is it just getting started?

[Anonymous Coward]

Actually, one of the big ISPs in the States (Road Runner) /does/ provide a virus scanner & firewall package to its customers for free. Of course, it's made by Computer Associates, but it's much better than nothing.

Re:Is it just getting started?

[jmvoodoo]

If the virus is encoded for the purpose of enforcing a copyright then it would be illegal to reverse or even attempt to reverse the encoding. That only applies to decompilation I believe, as reverse engineering ala AMD/Cyrix is completely legal under the DMCA as it involves creating from scratch a compatible system, rather than reversing a copyright protection in order to duplicate a system. That's just my understanding of course. But even if the virus was covered under the DMCA I doubt any virus writer would be so stupid as to come forward against McAfee/Symantec/CA/etc claiming copyright infringement in a U.S. court, as that would likely result in their arrest :)

Re:yah!

[patsalov]

So if it doesnt do the DOS or provide a backdoor, what does it do?

Re:MyDoom (OT Response)

[Anonymous Coward]

Wow, 666999 is a pretty kinky number if you ask me.. O_o

Part of the story?

[Anonymous Coward]

instead scans for machines with an open TCP port 3127

Uh, ok.. so what is on port 3127?

We are not all so nerdly that we memorize port tables... (emphasis on ALL)

Re:Part of the story?

[centralizati0n]

3127 is apparently the backdoor created by the other mydoom viruses. As another poster mentioned, its a giant botnet, now at someone's disposal.

Re:Part of the story?

[mattjb0010]

Orange:~/PhD> cat /etc/services | grep 3127
ctx-bridge 3127/udp # CTX Bridge Port
ctx-bridge 3127/tcp # CTX Bridge Port

Re:Part of the story?

[YOU LIKEWISE FAIL IT]

I'm amazed that someone else hasn't already jumped on this hole. From the analysis I read, you just plonk two bytes down, and then pipe in the executable, and the victim machine runs it. I mean, nmap tied together with netcat would be enough to build an exploiter.

I am more amazed that neither SCO nor Microsoft didn't start tailing their http logs, and firing a disinfector back at hits that match the fingerprint of the ddos thread spool. I know, I know... hackback is bad, but in this case...

YLFI

Re:Part of the story?

[PacoTaco]

Some PhD! You know, you can just do:

grep 3127 /etc/services

Re:Part of the story?

[Anonymous Coward]

grep can take a file name as an argument you know.

Re:Part of the story?

[Tuxedo Jack]

So this could possibly be another tool for opening ports for spammers. Joy.

Also, Roadrunner will clog your inbox with bounce messages or "sent from a RoadRunner IP" messages. I told my clients about this, and they've instituted a mail-block policy on any and all RR servers until they turn it off.

Re:Part of the story?

[mattjb0010]

I wanted to read it first, thus I did
cat /etc/services | less
cat /etc/services | grep 3127
using up arrow and delete rather than back arrow, just a habit I'm in to. Plus, it's hard to think in the 100F+ heat :)

Re:Part of the story?

[PacoTaco]

cat /etc/services | less

I'm still not getting through here...

Re:Part of the story?

[JPriest]

Because you can't
less /etc/services | grep 3127

Re:Part of the story?

[rgigger]

uh... Microsoft can't "tail" their http logs

Re:Part of the story?

[Anonymous Coward]

'less /etc/services' hit / type 3127

Re:Part of the story?

[Anonymous Coward]

I am more amazed that neither SCO nor Microsoft didn't start tailing their http logs, and firing a disinfector back at hits that match the fingerprint of the ddos thread spool. I know, I know... hackback is bad, but in this case...

Microsoft could get away with it, and call it part of their new Windows Update.

I actually wanted to do this on our campus when Blaster hit. The code was out there to exploit the RPC vulnerabilities. If you only patch systems which are actively trying to infect you (from your own subnet), it's not going to get out of hand. I called it "managed desktops". Maybe it's not as conventional as SMS or ZENWorks, but it would be effective. Besides, it's not hacking if you do it to your own systems.

I wanted to give a little pop-up for the users which gave them 2 choices:

Do you want to be managed by
() The University
() Hackers

Giving users a choice is just the right way to handle things. You can't just go around forcing your opinions on them.

Re:Part of the story?

[Anonymous Coward]

Parent wrote:"Because you can't
less /etc/services | grep 3127"

Uh? have you tried it.
Not only does it work, it does exactly what you expect. (Hint: less knows when it's running on a terminal)

here's an idea

[Tibor the Hun]

Wouldn't it be nice if someone would write a virus that exploits the same RPC patch vulnerability as welchia and then starts DDOS ing Microsoft?

That way every time I forget to disconnect a freshly ghosted machine, Microsoft gets a nice little "Hi Mom!" message.

Round 3 is on!

[i_am_syco]

This one seems to be more of an act of desperation. Maybe the writer thinks he's going to get caught soon?

Re:Dumbass alert

[bcore]

Anyone infected by email virii should have their internet access revoked for being too damn stupid. Stop opening every fucking attachment you get, morons!

Did you happen to notice the part where it said This new variant apparently doesn't spread via e-mail but instead scans for machines with an open TCP port 3127?

Hmm...

[Cyno01]

Just from the description in the /. blurb this seems to have a very different purpose from A and B. This seems like a script kiddie just for the hell of it kind of thing more than a spam tool.

Re:Hmm...

[LostCluster]

I don't know if this is a script kiddie. It's somebody who very deeply understands the MyDoom code because they were able to exploit the security hole opened by the original virus.

Re:Hmm...

[YOU LIKEWISE FAIL IT]

I seem to recall the mechanics to exploit this hole discussed in the virus analysis put around in the wake of MyDoom.A. So unless I'm imagining this, I'm not sure I agree.

Regardless, watching a captured sample of MyDoom.B with Ethereal or similar will show it trying to propagate itself over the top of MyDoom.A, hence giving away any particular magic required.

Re:Hmm...

[Anonymous Coward]

Like some other comments have mentioned, exploiting the hole is trivial. You could telnet to the right port, send a couple bytes, and point it to your chosen executable, if somebody (like the virus description) told you the right couple bytes to open it. You just need free time and literacy, no deep understanding necessary.

MSN messenger?

[Quixotic]

Does anyone know if it is slamming the msn messenger service as well? I havn't been able to connect to it recently, and it seems to be a network wide outage, since other people are having problems as well....

Re:MSN messenger?

[ShallowThroat]

Yes, yes it is. I have contact. resort to ICQ/Jabber.

Re:MSN messenger?

[Phroggy]

Probably. I can't connect either (worked fine before about 2pm PST / 10pm UTC Monday).

Re:MSN messenger?

[ePINOY]

Darn, MSN Messenger is down, what a pity...o wait I can't connect neither. :(

Re:MSN messenger?

[JackAsh]

MSN Messenger is down for me as well. I'm just glad to see that the Messenger Network Status page is up to the task of telling us if things are up or down (not!).

-JackAsh

Re:MSN messenger?

[Quobobo]

Just confirming that I can't connect either (on OSX if that means anything).

Re:MSN messenger?

[dubbreak]

Personally i like this status page.

For those too lazy to click the link it says and i quote,
"All systems stable and running".
Microsoft calling something stable, that's a bit of a reach...

Re:MSN messenger?

[Anonymous Coward]

and even better is that that page is down right now. YIPPY, Microsoft is so wonderful.

Re:MSN messenger?

[Anonymous Coward]

Possibly - cant say for sure, but if the actually MSN messanger works anything like the IM features of exchange 2k it does rely on an IIS webserver for most of it's functionality, if their webservers are the the same as used for MSN this could cause it.

Also, Netcraft is reporting that they are dropping requests without a user agent, and from logs on my windoze servers it appears the exchange version does not report one.

Re:MSN messenger?

[tasinet]

if that means anything
Of course it means something! It means you're wasting an OSX machine with MSN! GOD! :o)
Whatever happened to good ole jabber? ;o)

Re:MSN messenger?

[Anonymous Coward]

Microsoft calling something stable, that's a bit of a reach...

That was a typo, it should have read Augean stable, as in:

Abominably filthy; i.e. resembling the stable of Augeas, a fabulous king of Elis, which contained 3,000 oxen, and had been uncleansed for 30 years, when Hercules, by turning the river Alpheus through it, purified it in a single day. - OED

.

Not really MyDoom.C

[jakoz]

Apart from the fact that it uses the backdoor created by MyDoom to spread, it doesnt have enough in common with MyDoom to be a variant of it, which is probably why on the CNET link it only mentions the name Doomjuice.

The MyDoom.C name used in links such as the ABC one is probably for good headlines

Re:Not really MyDoom.C

[toddhunter]

Actually I read that the MyDoom.C name comes from Microsoft. Probably so named so that the masses think it is the same virus attacking their computers rather then a new fresh one.

Re:Not really MyDoom.C

[Basehart]

They should start gibing viruses version numbers: MyDoom.C version 1.1

Re:Not really MyDoom.C

[Anonymous Coward]

They should start gibing viruses version numbers: MyDoom.C version 1.1

That's so 1980s.

They should call it "MyDoom XP".

Re:Not really MyDoom.C

[httptech]

Regardless of how many functions changed, it is a variant in the sense that it came from the same source tree, as opposed to DeadHat, which is from completely separate source, yet similar in spreading functionality.

The name MyDoom.C came from me, since I was the first to post an analysis of it at http://www.lurhq.com/mydoom-c.html

The AV companies decided to rename it because it isn't a variant by their strict definition. Apparently in the AV world, a variant doesn't even have to be by the same author, as long as it is very similar.

--
Joe Stewart, GCIH
Senior Security Researcher
LURHQ http://www.lurhq.com/

Re:Not really MyDoom.C

[Anonymous Coward]

Juice is generated from fruit.
My doom was fruity.
I enjoyed playing that game for years!

source code?

[k4_pacific]

The worm's code is not encrypted, but it contains all of the source code for MyDoom.A.

Hence the name mydoom.c

Question about this virus and its activity

[GeckoFood]

About the time the first version of this virus set sail, I noticed a huge spike in the number of Backdoor/Subseven probes against my firewall (still ongoing). Is this little bastard responsible for that, or is this caused by another issue altogether?

Seems to be doing some damage already.

[IllogicalStudent]

MyDoom.C's effects seem to already be felt. My girlfriend's been complaining that she can't get onto MSN all night, and sure enough messenger.msn.com is completely unresponsive, as was Hotmail a few hours ago (though, it seems to be up now). I wish I could just convince her to use Jabber.

Re:Seems to be doing some damage already.

[MajorDick]

DOLT !

MyDoom.c is the SOURCE FILE !

NOT A Variant, the thinjamjig that takes advantage of mydoom A and mydoom B infected machines is called DOOMJUICE !

Doomjuice leaves a COPY of the original source MyDoom.c on the infected computer

Re: Seems to be doing some damage already.

[Black Parrot]

> My girlfriend's been complaining that she can't get onto MSN all night

Shucks, you two will just have to find another way to while away the hours.

(Write me if you need suggestions. I can do ASCII art for the complicated stuff.)

Re:Seems to be doing some damage already.

[Anonymous Coward]

Strange thing, this thing has been doing the rounds on the corporate network at work while the other variants have not penetrated. A lot of jetdirect / HP print servers were in a non functionaing state this morning on the network and needed to be reset. Has anyone else seen this?

I wouldn't attribute it to the worm except for the last case of a worm not recognising print shares and attempting to copy itself to those too resulting in piles of garbage prints after a weekend.

Re:Seems to be doing some damage already.

[lbrt]

My girlfriend's been complaining that she can't get onto MSN ...

Is that some new Virus or a MyDoom variant? As a fellow slashdotter I'm worried, can your anti-virus software remove MyGirlfriend from your beloved computer?

No shutoff date?

[ArsonPanda]

I never understood why viruses/worms/whatever bother to include shutoff dates. "hum, I really hate SCO, so I'm going to DDoS them, but only for a few days" Why?

Re:No shutoff date?

[Anonymous Coward]

Because you want the bandwidth of the internet to be available next week for the next virus.

Re:No shutoff date?

[VertigoAce]

I've seen speculation that some authors do it so their previous work won't clobber whatever their new project is. It might also be useful to get around certain automated anti-virus tactics. On a university network it isn't uncommon to disconnect a computer that seems to be infected with a particular virus (ie all addresses resolve to a page telling you that your computer is infected and pointing you in the right direction). So after a few days all of the infected computers suddenly act like normal ones, ready to be infected with the next variant.

Re:No shutoff date?

[doorbot.com]

I've seen speculation that some authors do it so their previous work won't clobber whatever their new project is. It might also be useful to get around certain automated anti-virus tactics.

Are you sure it's not a form of one-up-manship or rival crime gangs trying to control the most massive armada of PCs ever assembled... one with a denial of service/spam power beyond your wildest dreams?

Anyone who could co-opt the MyDoom infected PCs (and then uninfect them) could pull the rug out from it's original creators. But who would benefit most from this?

Re:No shutoff date?

[bill_mcgonigle]

Because it's just a diversion anyway. You want your zombies to be free to send your spam when you're ready.

no backdoor

[stev_mccrev]

This version appears to be a very stripped down version of it's earlier cousins since it also doesn't leave a backdoor into infected machines

It doesn't open a backdoor, as TCP port 3127 is the port that the MyDoom.A and .B backdoor opens.

This isn't really a variant of the same virus as it only attacks machines already infected with MyDoom, rather than spreading via email.

Re:Dumbass alert

[ergo98]

Did you happen to notice the part where it said This new variant relies upon a backdoor left in place by the original email spread virus.

I'm not sure what to think about this: How many times can you tell people never to open attachments until you just give up and accept that a certain casualty rate is to be expected? (As a sidenote -- I party blame Netscape and other email proggies that send forwards or replies as attachments rather than as inline quoted text. This makes uses accustomed to opening attachments).

What's next?

[Anonymous Coward]

Well, that's it: it's officially time to save stupid computer users from their own ineptability.

The next variant of mydoom should close port 3127 and install a virus scanner on the hosts computer that automatically updates and scans in the background.

The internet is a minefield now-a-days.

Re:What's next?

[Anonymous Coward]

Only if you use an OS from Microsoft.

Re:MSN messenger? Yes....apparently

[simetra]

I just tried to use it... couldn't connect. I tried a few times and gave up.

(sigh)

[BenSpinSpace]

After that article a couple of days ago about the hackers, I was wondering how new potential "script kiddies" would react... would they go in search of viruses and start sending them out, inspired by the article? Oh well, it doesn't matter. Now, for a horrible joke! What did the dog call the cat who was an amateur hacker? A script kitty! (sigh)

Re:(sigh)

[ozric99]

Never mind the veal. Cheque please!

Any legit use for 3127?

[LostCluster]

Are there any real applications that use port 3127, or can we safely block that port at our firewalls?

Re:Any legit use for 3127?

[nmoog]

Yeah, port 3127 is used for DoS attacks on Microsoft. Its best to leave it open.

Re:Any legit use for 3127?

[rusty0101]

It should be safe to block. I did a 'grep 312 /etc/services' and came back with only one hit, 3128 for Squid proxy. That should be blocked at your firewall as well, as having it available to external users can open your mail server to become a spam server if you have them both on the same network. So you could probably block the range 3120-9 with out any negative impact.

-Rusty

Re:Any legit use for 3127?

[MalleusEBHC]

Are there any real applications that use port 3127, or can we safely block that port at our firewalls?

If you have to ask, it should at the very least be blocked inbound already.

Re:Any legit use for 3127?

[grub]

Ideally a firewall is in a default deny state. That way you can open it up for things you know you need rather than missing something and having a hole into your LAN. If you followed that advice then you wouldn't need to worry about closing the port.

Re:Any legit use for 3127?

[zerocool^]

Not according to my relatively old, but still useful, ports list. (Credits to Jason/Play from #irchelp on irc2.att.net and darkbot)

~Will

Re:Any legit use for 3127?

[stratjakt]

You should block all incoming ports you dont need. Only open ones for services you deliberately run, like a game server or ftp or whatever..

At home I have only ssh exposed to the world, and on a nonstandard port at that. From there I can ppp over ssh and do whatever I want. Fine for a home network at least.

Outgoing ports I only monitor logs from now and then, to make sure a virus/trojan didnt find its way on to my wifes, or one of the kids boxes.

Re:Any legit use for 3127?

[Brandybuck]

Where do you people come from! Is it time for another application of the ClueStick(tm)!

If you're not using a specific port, close it up. That includes 3127. And everything below 3127, and everything above 3127. Close them ALL off except the ones you are specifically using.

Now I realize that this is extremely difficult to do in Windows, but do it anyway. Repeat, do it anyway. This is your responsibility as the owner of a node on the network. And don't think you're done just because you're secured the firewall. Secure all of your client systems as well. My company got hit hard by Blaster because someone walked into the lab with a laptop.

Re:Any legit use for 3127?

[dubbreak]

huh? I checked you list, there were no entrie for 3120-3129 so why no have all of them blocked, no essential services will be missed.

Re:Any legit use for 3127?

[Anonymous Coward]

http://www.iana.org/assignments/port-numbers

Re:Any legit use for 3127?

[lakeland]

to make sure a virus/trojan didnt find its way on to my wifes

Learn how to use the apostrophe key. Else you might get misunderstood.

Re:Any legit use for 3127?

[builderbob_nz]

Damn, and I thought there was hope yet... imagine a harem for every slashdotter!

Re:Any legit use for 3127?

[BetterThanCaesar]

A beowulf cluster of wives!

Re:Any legit use for 3127?

[Anonymous Coward]

The op was probably talking about larger network where he can't tell what services are ment to be running..

Re:Any legit use for 3127?

[Anonymous Coward]

except that the plural for wife is wives

go see dictionary.com

Re:Any legit use for 3127?

[zerocool^]

That's what I meant. Check the list, if nothing needs those ports, just block 'em.

~Will

Re:Any legit use for 3127?

[slide-rule]

>> to make sure a virus/trojan didnt find its way on to my wifes

> Learn how to use the apostrophe key. Else you might get misunderstood.

Since there's an SCO conspiracy link in every good story, maybe he just lives in Utah. Think about it... ;-)

Re:Any legit use for 3127?

[Anonymous Coward]

"Now I realize that this is extremely difficult to do in Windows, but do it anyway."

No, its trivial. You always always always use a hardware based firewall.

Get a Linksys; they work reasonably well, they're cheap, and they don't depend on somebody doing or not doing something.

Then on your PC, you use Zonealarm Pro to watch for suspicious activity *outbound*.

Using a software based firewall for inbound protection is just dumb.

Re:Any legit use for 3127?

[Skater]

I like to pick on the Mormons as much as anybody...possibly more than anybody else. (I'm not Mormon, I'm atheist.) But, fer cryin' out loud, this joke is old. The Mormons changed the multiple-wives doctrine about a century ago, and Utah outlawed it around the same time.

Read up on Mormons and get some new fodder for humor. Don't worry-you can retire this joke and still have plenty of material. Trust me. :)

Thanks.
--RJ

Re:Any legit use for 3127?

[zerocool^]

OK, i get it. I messed up, i meant to reply to your parent post, the one that was like "is there any legitimate use of this port", and the answer is "no". But, you already knew that.

My bad.

~Wx

Re:Any legit use for 3127?

[Tin Foil Hat]

How can you be sure it was a puctuation error? Maybe he meant wives and his spelling sucks.

Re:Any legit use for 3127?

[OneFix at Work]

Umh, that's easy when it's your own personal network or a small office...it's not so easy when you have thousands of users...

Someone is always using some obscure application to talk to BFE and when they cant use it, they are suddenly the most important person on the planet...

Securing your network is simple, dealing with the implications are not.

Re:Any legit use for 3127?

[rakerman]

I suggest you look the port up. In the IANA port list or you can use any of a number of searchable port lists.

They will tell you the port is IANA registered by EMC for CTX-bridge. It's up to you to decided whether that counts as a "real application".

Re:Any legit use for 3127?

[Abcd1234]

And you deal with those on a case-by-case basis. Frankly, if you don't know *exactly* what applications are being used on your network at any given time, even on a system with thousands of users, your IT department has done something seriously wrong. Especially considering it's the job of IT to install and support these applications in the first place. And if you break some small fry's application because you weren't aware of it, tough sh*t. It's not one of the IT-supported applications, so it's their problem if it suddenly breaks.

Re:Any legit use for 3127?

[Brandybuck]

it's not so easy when you have thousands of users...

Oooh, suddenly the situation changes from a single user sitting at home wringing his hands, to the head of IT at a major corporation. Guess what? You have even MORE responsibility to secure those systems! I have no sympathy for you. You're a professional, start acting like one.

Re:Any legit use for 3127?

[Shurhaian]

In that case, it'd be "wives'".

Still an apostrophe issue, which is also seen in "didnt"[sic]. Occam's razor steps in: "wifes" meaning the plural would require two errors(spelling and punctuation) as opposed to just one(punctuation alone).

Now, plainly, people can screw up many times in a row, but let's give a little bit of room here.

It attacks Microsoft?

[Stupid White Man]

It attacks Microsoft without a shut off date?

Sooo.. uhhh... where... can... I ... download a copy of this virus?

I'll spread that mofo across my network like SETI@home.

ATTACK!

Re:It attacks Microsoft?

[Anonymous Coward]

So... let me get this straight...
You have a network under your control, right?
You hate MS, right?
Since you want to "deploy" this new virus targeted at win machines, that means your systems are running windows, right?
Why exactly are you running windows and contributing to the monopoly again?

Apologies if you're a simple/lowly network admin under the thumb of a clueless CIO/CTO

Re:It attacks Microsoft?

[Stupid White Man]

Sorry brother. Just a lowly netadmin. (I personally run linux) We do what we can with what we have.

An idea revisited...

[tekiegreg]

I'm sure we've learned enough by now to determine how this virus works to the point where we can create a worm of our own and disable it's DoS attacks. I for one believe enough is enough, and it would be ethically ok to go ahead and create such a worm. All we'd have to do is infect in the same way this new virus does, and run arbitrary code to destroy the virus. Thoughts?

Re:An idea revisited...

[inertia187]

I'm a blind worm, you insensitive clod!

Re:An idea revisited...

[Tony-A]

I for one believe enough is enough, and it would be ethically ok to go ahead and create such a worm. All we'd have to do is infect in the same way this new virus does, and run arbitrary code to destroy the virus. Thoughts?

I agree, except ....
You have to be good, very good.
Do it once. Do it again. It's not really reapeatable.
Bad copies will be made. Unforseen consequences.
Good copies will have the same unforseen consequences, just slower.

Re:An idea revisited...

[Anonymous Coward]

Been there, done that (blaster, welchia), got the "I tried to stop a bad worm with a good worm, and all I got was this lousy wasted bandwidth!" T-shirt.

From an admin's point of view, BOTH were an equally bad nuisance and bandwidth hog. Hopefully, we've all learned enough by now to NEVER make such go-fix worms ever again. Cure is definitely as bad as the disease.

Re:An idea revisited...

[JPriest]

You do know that this is what Nachi did and it turned out to be worse than Blaster that it was sent out to get rid of. Why don't you just let the virus propigate for 48 hours then clean the disk while you are at it.

Re:An idea revisited...

[Anonymous Coward]

The time on clients might be set wrong, so you'd need some other test to determine if the cleaning/scanning should continue. Maybe only clean if some headline on some high profile website is present? Get the current date from some website? Could use a timeserver, but usually webpages are easier to get at from behind a firewall

Re:yah!

[rusty0101]

ReRead article.

This is a parasite that takes advantage of the infection created by the earlier virus. It looks for systems that are vulnerable as a result of the earlier infection, and copies itself to them.

Additionally it provides instructions to the part of the system that was infected that causes it to go out and perform the DOS on (at the moment) Microsoft's web site.

Functionally it appears to be a macro virus that takes advantage of the installed application that already exists. It only runs on those systems, but affects other systems as a designed side effect of the macro.

-Rusty

Of course it doesn't leave a backdoor

[PickyH3D]

That's what MyDoom.A was for and how it breaks in.

Somebody please...

[zeux]

Write a virus that scans for open 3127 TCP Ports, get into the machine and remove MyDoom from it.

This virus counter-virus wouldn't cause the same problem than the SoBig counter-virus (can't remember the name, sorry) because this time it would spot only actual infected computers instead of every computer with an open RPC port.

Re:Somebody please...

[Anonymous Coward]

Why not fire up that virus creation util from the earlier NYT story about virues writers?

Re:Somebody please...

[Qzukk]

Err Huh?

The only way to find the computers with open ports is to scan them. And this is what is the big problem with the counterworms. They infect a host and go on the offensive, spewing as much traffic as the original infected host did, making us scratch our heads and wonder why.

I wish people would take the high road and let the losers who can't admin their way out of a paper bag wallow around in their own ignorance, but if you feel like you must absolutely write a counterworm, please, please, PLEASE make it only counterattack against boxes that are connecting to the host!

For example, instead of scanning for machines, simply lie in wait on a computer, and when something connects to you on 3127, then attack and clean that computer, and only that computer.

Re:Somebody please...

[stratjakt]

I always thought a clever counter-worm would use a swarming/distributed technique, to cut down on the scanning..

Using bittorrent as an example, they all connect to a central tracker, and each is assigned a subnet to scan and clean, they scan that range, pass on to the first infected machine found, and shut down, and that machine takes on the rest of the assigned range..

Lather, rinse, repeat. Every machine gets scanned once, in a nifty distributed fashion.

Just random thoughts in my head, frankly I dont care what a worms purpose is, I dont want it on my network.

Re:Somebody please...

[PacoTaco]

For example, instead of scanning for machines, simply lie in wait on a computer, and when something connects to you on 3127, then attack and clean that computer, and only that computer.

A cool enhancement would be to leave a friendly worm on the recently cleaned computer for a while (say a couple days) that cleans any other machine that attacks it. This would have a much greater impact without any scanning.

Re:Somebody please...

[Anonymous Coward]

Good plan, but you'd want each machine to find and clean at least 2 servers for the scanning to be time effective.

If each scanner only has one child then the network never increases in size, limiting the scanning speed to the number of initial seeds for the counter-virus.

Re:Somebody please...

[SurfaceMount]

Unless you are realy good and know everything dont try to create a counter-virus, there will be a bug and it will turn nasty.
The virus infects Microsoft computers, it attacks Microsofts web services, Microsoft are the experts in their own software(?). Let them fix it themself.
(yuck! said the name of evil three times in a row, I feel so dirty)

Re:Somebody please...

[TrancePhreak]

Well said

Re:Somebody please...

[Anonymous Coward]

You just need to passively listen on port 3127. When you are attacked on that port, you know the attacker is infected. Take advantage of the backdoor on the system attacking you, and patch it.

Or, if you're evil, patch their system, remove the existing virus and backdoor and install your own port knocker back door. Who would guess that a system that's 'not listening' on suspicious ports and is not spamming the network is infected?

Active port scans would get out of hand, and end up DoSing things all over the place.

Re:Somebody please...

[johnjosephbachir]

well, the easiest way would be for the DDoS target (in this case microsoft) to log the IPS of machines participating in the attack and send the list to appropriate ISPs.

This Internet isn't for me

[bigberk]

Aunt Bertha switches on her 2 GHz supercomputer, and hooks up to the Internet with a connection speed that would have rivaled an ISP in the early 1990's. She sees a pretty icon in her inbox, so she points and clicks, unleashing some spammer's latest mass-mailing creation. By the time Bertha goes and gets a triscut, she has already spammed a million Internet neighbours.

Anyone else see why the Internet is full of crap? And if you think it's as easy to control as "blocking port 25" ... ha ha. You wish! The worm only has to send mail via the ISP's outgoing mail server (remember... the one you reminded me "I should be using")

So no, controlling this spam/virus menace isn't quite that easy. Whatever method you use to legitimately send mail, the worms will follow that same method.

Re:This Internet isn't for me

[dont_think_twice]

Hmmmmmmmmmmm, triscuts.

Were you saying something?

Re:This Internet isn't for me

[tasinet]

2GHz is a supercomputer? boy, are YOU 1.4 GHz back in updates! You need new definitions for /dev/brain/news/cpu! We are at P4E 3.4G now!!

Besides the fun, maybe people should really take an exam before buying a computer more than 133mHz..
"You spot an icon called 'RUN_ME_I_AM_A_VIRUS.EXE'. What do you do?"
a] Call the police
b] Open it and run it
c] run it and open it
d] run it
e] open it
f] Police the call
g] [maybe delete it and empty the recycle bin RIGHTNOW?]
i] go buy a triscut

Re:This Internet isn't for me

[Anonymous Coward]

j] ...
k] Profit!

Re:This Internet isn't for me

[JPriest]

But the post you link in Google groups does prevent worms from using their OWN SMTP engines, Forcing them instead to pass through a mail server run by a paid administrator that has the ability to add spam and virus filters. I think blocking dynamic IP addresses from mail servers is a great idea.

Re:This Internet isn't for me

[Anonymous Coward]

Unless of course, we limit email to text-only, and put the "genie back in the bottle" as far as file attachments are concerned. Not possible, I know, but one can dream... I too remember when USENET was a useful tool.

Re:This Internet isn't for me

[ce25254]

So no, controlling this spam/virus menace isn't quite that easy. Whatever method you use to legitimately send mail, the worms will follow that same method.

What if your SMTP server requires authentication? If the ISP blocks port 25, and requires some sort of authentication, the worm would also have to figure out how to authenticate, right?

Re:This Internet isn't for me

[Anonymous Coward]

I had an epiphany yesterday... this is exactly what ipv6 is good for. People with a clue all use ipv6 and eventually turn off ipv4 when enough content is available via both, or ipv6-only. Let the "toaster users" stick to their ipv4....

Re:This Internet isn't for me

[firewood]

2GHz is a supercomputer? boy, are YOU 1.4 GHz back in updates!

Looks like you bought Intel's MHz myth. If you look at the highest performance machines on the top-500 supercomputer list, most of them clock even slower than 2 GHz (except VT's Big Mac), but they are all still way faster than a typical P4E box at any big (supercomputer size) problem.

Re:This Internet isn't for me

[slittle]

Uh, that's coz they're all clusters? And a lot of them aren't even general purpose CPUs?

Re:This Internet isn't for me

[ZorbaTHut]

Oh, come on. Once it's going through a known good computer, it's easy to deal with assuming the sysadmins are competent.

(1) It's known where it's coming from, since our competent outgoing mail server has authentication turned on and won't accept emails with invalid "from" addresses.
(2) It's easy to see that suddenly Aunt Bertha, who averages 5 emails per day, is sending 50,000 per second. And easy to block - this can be *automated*, too. If someone sends ten substantially identical emails in the space of five seconds, put a hold on the account and flag it for review. If they stop, send the emails and remove the flag after five minutes. If, on the other hand, they keep sending thousands of emails, it's pretty clear they've been exploited.

Re:This Internet isn't for me

[bigberk]

Oh, come on. Once it's going through a known good computer, it's easy to deal with assuming the sysadmins are competent.

You're right about that. However, the ISPs you're asking me to trust are the same ISPs that never answer their abuse@ account roles, who host spammers for years, and who don't implement even the most basic virus filtering on their servers.

What about a CodeBlue variant?

[SinaSa]

When CodeRed and CodeRed 2 came out, didn't someone design a Code Blue worm which infected CodeRed{2} boxens and patched them? Can't someone do the same here?

Re:What about a CodeBlue variant?

[MalleusEBHC]

A similar situation occured with Blaster and Welchia. As a network tech who had to deal with the mess, I must say that Welchia made matters much worse. It added to network traffic even more, thus slowing down an already congested network. Additionally, it makes diagnosing the virus harder. Instead of being able to see someone spamming port 135 and knowing it's Blaster, now you have to look for Blaster and Welchia.

While it's a somewhat noble idea, in the real world it is just another pain in the ass.

Re:What about a CodeBlue variant?

[mrtroy]

You know when you feel like you have something really clever to say and want to say it really bad cuz you think its so amazing?

Here it is!

Why dont I create a machine that will fix your car for you too, and mow your lawn, and take out your trash and solve that pesky virginity problem of yours?

Because thats why WOMEN were invented! They solve all of the worlds problems! Go away from your computer, and find a woman who will download the new anti-virus definitions for you and solve the rest of your problems!

Now to all the women out there: YES, I am avaliable, please send me your resume containing important skillsets outlined above.

(but seriously, I am going to die alone)

is this effecting MSIM?

[l0ungeb0y]

I run OSX and my MSIM has not been able to contact the service for a few hours now. Not sure if this is related to MyDoom, but the MSIM service has been rather spotty the last couple days.

Re:is this effecting MSIM?

[BillX]

I haven't been having any problems with my copy of Multisim.

Target American Idol !!!

[simetra]

This is the perfect opportunity for someone to fix American Idol, by getting all those zombie computers to dial and vote for their favorite singers!

Re:Target American Idol !!!

[iphayd]

With the increase in talk about online voting, I think we have a little more to be afraid of than "American Idol" getting fixed.

Re:Target American Idol !!!

[Lars T.]

You make it sound like a bad thing - it can't get much worse. Instead of corporations, the best hackers would decide who runs America.

Re:Target American Idol !!!

[iphayd]

No, the best hackers would get paid to allow corporations to run America.

Re:Target American Idol !!!

[builderbob_nz]

Was I the only one who read this as American's Idol getting his nuts cut off? {sorry if language offends}

Re:Target American Idol !!!

[sadler121]

Wake up call, American Corperations ALREADY decide the president! Big Oil and the Entertainment industry just take turns picking the prez and the rest of congress. ;-)

Re:Target American Idol !!!

[Lars T.]

So who pays the hackers that attack SCO and Microsoft?

Re:Target American Idol !!!

[cheekyboy]

No, the real 'hackers' do it to make oney.

1. you become a registered advertiser of a 1900 sex phone line, where you get a 30% cut if their call rates improve.

2. you get 1000000x of computers to call and stay online for >2 mins 15mins.

3. you pocket 30% of 10000000x * 15 * $3.95

4. you live in the bahamas/cayman islands, and laff.

Re:Target American Idol !!!

[NatasRevol]

Now, which step is ???

Re:Target American Idol !!!

[That's Unpossible!]

But the world just isn't ready for a l1B3r+4r1@n pRe5I|)3nT...

Re:Target American Idol !!!

[HiThere]

Spammers?

Favourite quote from the article

[Slashcrunch]

Mydoom.A shut down the site of SCO, owner of the Unix operating system

Bwahahahaaa!!! Hope they checked the rest of their facts better :)

Parasitic Viruses attacking My-Doom Infected Boxen

[billstewart]

Unlike MyDoom, which is exploiting Microsoft weaknesses, the interesting thing about Doomjuice and Deadhat (aka Vesser) is that they're scanning for the back doors left by MyDoom.A and MyDoom.B and using them to take over. The good news is that they're only attacking infected machines (and in a way that's easy to block), but the bad news is that parasites like these can add nasty payloads to viruses that were fast but not particularly nasty themselves. (That doesn't mean that these parasites have done that, but they can.) According to the article on F-Secure, Vesser / Deadhat turns off many kinds of anti-virus and firewall software, leaving the machine more vulnerable, and adding a backdoor of its own (but protecting it with crypto, which is the proper thing for an evil virus to do :-)

When will someone use this to their advantage? ...

[LnxAddct]

Anyone know if MyDoom's protocol for port 3127 is documented anywhere? If the virus writer can send it patches, then surely we can too :) We could have this mess cleaned up in a few days if we made the patch clean the machines. Not sure if cleaning people's machines without their permission is illegal, but itd sure make a lot of people grateful. If anyone does do it make sure to sign it as a gift from the opensource community so we look really good instead of the evil people that we've been made to be.
Regards,
Steve

Speculation on Doomjuice purposes

[billstewart]

Early articles had some speculation that it must have been written by the original author of Doomjuice. On the other hand, there are now two parasitic viruses out there (Doomjuice and Deadhat) taking over MyDoom-infected boxen, so it's probably easier than that security expert thought. And Deadhat (aka Vesser) kills off any anti-virus and firewall software it can find, leaving a properly encrypted backdoor for its own 0wner to use.

So far...

[Anonymous Coward]

There are scans on 3127 - but only two in the past hour to my IP address.

SysAdmin of the hose?

[freakmn]

I hate picking on misspellings, but I just think that was funny! With my luck, I'll misspell something, too.

Re:SysAdmin of the hose?

[koreth]

Well sure, because the computer is obviously hosed. Makes sense to me.

Re:SysAdmin of the hose?

[Anonymous Coward]

I hate picking on misspellings...

Ummm...then don't do it if you hate it!

Obviously, I like picking on dumbasses ;)

Re:SysAdmin of the hose?

[redJag]

Damn, at first I thought you were talking about Comuputer, and I could absolutely not draw the connection..

MyQuake

[Neo-Rio-101]

After MyDoom.c we can probably expect MyQuake.a, as well as a sequel MyQuake.b... and maybe even MyReturnToCastleWolfenstein.a Unfortunately MyDoom.3d will only run on the latest graphics cards and DirectX9 hardware... and will spend years in development. Andy better not be working at id

Re:MyQuake

[grolschie]

MyDoom.III will no doubt be vaporware though. :-)

Re:MyQuake

[b0r0din]

MyDoom.Forever!

Re:MyQuake

[Anonymous Coward]

MOD UP !

FUNNY!

Re:MyQuake

[_Sprocket_]

MyDoom.III will no doubt be vaporware though. :-)

Although some networks will allow you to be pre-infected with an empty shell virus that will automatically download and install MyDoom.III when it begins to spread.

Re:MyQuake

[PhyreFox]

MyQuake.c will be primarily used to stress-test machines and then post the results everywhere it can.

Re:MyQuake

[Master of Transhuman]

This is called Microsoft Update.

Don't forget to read the EULA.

Re:MyQuake

[Endive4Ever]

And, of course, MyHeretic.a for people who want a richer, more complex FPS playing environment.

Re:MyQuake

[Anonymous Coward]

Then there is the is a virus called MyDukeNukemForever... it never actually gets around to mounting an attack, though...

Re:MyQuake

[Anonymous Coward]

Not as much so as the amazing MyDukeNukemForever.a worm. Thats been in development...well...forever

Re:MyQuake

[builderbob_nz]

and after that they can all get together for an infection match to form MyQuake.Arena, the beowulf of viruses

Re:MyQuake

[mikvo]

Actually, MyDoom is just the sequel to MyDocuments, found on most Windows computers.

Re:MyQuake

[icedcool]

And all of this will come out before Myhalflife.2, because there was a code leak to the antivirus companies...

Re:MyQuake

[88NoSoup4U88]

Im allready working with the source of the myHL2 virus ;)

postmaster@bestbuy.com

[Anonymous Coward]

i just got an email from postmaster@bestbuy.com and it said the mydoom virus had been stripped from this email....not sure if yahoo stripped it or if it was stripped before it got to yahoo

The Virus We Need.....

[simetra]

I've said this before and will say it again.

The virus we need is one that changes the wallpaper on a Windows(tm) machine to a big crotch shot. It can't be that hard, maybe a simple registry key, or an ini file modification.

In light of the recent Janet Jackson breast fiasco, I think you'll agree that Jane and Joe Jackass End User need a little more exposure to such things so they won't get their knickers in a knot over such silly crap.

Thanks.

Re:The Virus We Need.....

[RetroGeek]

changes the wallpaper on a Windows(tm) machine to a big crotch shot.

If you are going to do something then do it right.

Change the wallpaper to either the tub lady or the goatse man. You will know which one to use by asking the user if they are male or female.

Re:The Virus We Need.....

[laugau]

While I may not agree with what you say, I will defend with my life your right to be a moron

Re:The Virus We Need.....

[Tin Foil Hat]

The virus we need is one that changes the wallpaper on a Windows(tm) machine to a big crotch shot. It can't be that hard...

Ahem. I think you meant to say difficult.

I hate to say it, I really do, but I think you're on to something. That would at least cause people to wake up to what this crap is all about. Besides, it's also a lot less damaging than the other stuff that could happen. Rioting in the streets, planes falling out of the sky, dogs and cats sleeping together. You know, stuff like that.

Re:The Virus We Need.....

[simetra]

Exactly. Right now people are very complacent, just update their virus definitions, or follow the advice of that newpaper moron Jim Coates and restore their system from their rescue cd whenever something doesn't work right on their pc. A nice big "Hello Baby" picture would get a lot of people thinking. Or at least it would give their televangelists something to whine about for a week.

I'm not supporting the virus or anything...

[Anonymous Coward]

But I kind of have to snicker at the fact that thousands of machines running software that Microsoft didn't care to make secure at all is now attacking them back. There's a certain poetic charm about that. But of course we all know that there's a special seat reserved in Hell specially for the guy who wrote this. He will be forced to use Windows RG until the day Hell Freezes over. (Then the computer will die, leaving him all alone.)

But seriously, might this turn of events make Microsoft think twice about releasing an OS that has more security holes than a truckload of swiss cheese?

PS: Anyone else have trouble logging in with the new release of FireFox?

Re:I'm not supporting the virus or anything...

[Anonymous Coward]

there was no security flaw in windows responsible for MyDoom.
It was user stupidity alone.

Microsoft

[loconet]

Microsoft is already scrambling to inform users to stop hammering their servers!

Several people report that it seems it might be affecting MSN servers?

Re:Microsoft

[ChaoticLimbs]

MSN messenger has not been able to connect all day. My wife confirms this at home. (I am at work).

He won't get caught dude

[Anonymous Coward]

I don't think he'll get caught anytime soon. One of the writers, if there is more than one, were attacking SCO. I don't think there are many people out there who are all these things:

1) smart enough to write a windows virus
2) BIG linux advocate
and most importantly...
3) stupid enough to get caught.

Not that it takes a rocket scientiest to write a windows virus, but this particular one does take some knowledge of how to use sockets (or whatever C# or .NET calls their own stupid abstraction).

In any event, most people who know how to do this have at least heard of ways to cover your tracks. Like hopping from rooted box to rooted box 20 times and writing self destruct codes that formats the disks of all those machines. If they didn't do something along those lines, then they deserve to get caught because they're a threat to our community! Just kidding.

Re:He won't get caught dude

[stratjakt]

1) they just modified an old one
2) most script kiddies are linux zealots because installing tarballs makes them feel like real hackers
3) what makes you think linux zealots are smart?

If dudes doin it for attention, he'll get caught.. He'll shoot off his mouth in some h4x0r channel, and get caught, like so many before him..

Re:He won't get caught dude

[Anonymous Coward]

They were attacking SCO?
Hmm, only 25% of infected machines attacked SCO, the rest kept spreading the virus.
The attack on SCO was a cover. YHBT by a virus.

Take a look on Groklaw for a little info.

Re:He won't get caught dude

[fwarren]

Yeah, like if I was going to spread a virus, I would do the following

1. Drive to a college town at least 30 miles from where I live
2. Go to a cybercafe as close to the college campus as I can find
3. Pay cash to use a machine for half an hour
4. Create a dummy hotmail accout
5. Send the virus out to some email addresses
6. Not be some stuipd candy ass and brag about what I had done

Re:He won't get caught dude

[thelasttemptation]

Thats odd... We have it right here the virus came from joe bob's cyber cafe about 30 miles from you from a machine the customer payed cash for and sent from a hotmail account s/he opened right there... Nah, couldn't be you...

Re:Dumbass alert

[Anonymous Coward]

Awww, but it said "I Love You."
How could it be harmful if it says "I love you"?

MSN?

[teknokracy]

Does this have anything to do with the fact that MSN Messenger isn't working, nor is the messenger.msn.com site? I could just be speculating... but MSN Messenger went down without notice a few hours ago. Microsoft could be "not telling us everything" regarding server issues... or they could just be screwed up like usual :D

Re:MSN?

[Zed2K]

I noticed this also, except the messenger status page says nothings wrong.

Netcraft confirms it...

[hkfczrqj]

Microsoft is dying.

Re:Netcraft confirms it...

[JPriest]

Microsoft deserves to take the blunt of this attack. Preventing this type of attack is not that difficult. Microsoft decided to close off all the open ports in SP2 after blaster and Nachi, maybe this will help motivate them to take steps to combat mail worms. If MS does not secure OE than AV companies can sell an alternate secure mail client.

Re:Netcraft confirms it...

[Anonymous Coward]

Since the worm is already installed on the machine, a software firewall will be pretty much worthless -- if the user is running as administrator, the worm can just open the ports.

Re:Netcraft confirms it...

[JPriest]

Re AC: My suggestion is that the email client and attachments be sandboxed so the worm can't gain administrator access outright. It would be hard to write a worm to bypass all the firewalls people are using but there is no need. The same people that open these attachments are the same people that just click "yes" every time the firewall pops up a message.

Re:Netcraft confirms it...

[Anonymous Coward]

From Netscraft's site
------

This morning at around 9am GMT response times to www.microsoft.com surged, and for a time the site failed to respond. Subsequently, the www.microsoft.com began dropping requests without User-Agent headers, apparently to differentiate between traffic from Web browsers and the DDoS attack agents. Our monitoring requests, which do not normally set a User-Agent, were also dropped. These were changed to supply a user-agent header on requests to www.microsoft.com around 2pm GMT and have since seen mixed results, with relatively normal results from London, but some extended and erratic response times from Atlanta, New York and Texas.
--------

thanks Netcraft! now all I have to do is remember to put a user-agent header into my next worm and then they'll be REALLY screwed. I hadnt thought of this issue before. now i am enlightened, and all those web sites are screwed

Re:Netcraft confirms it...

[Odin's Raven]

Microsoft is dying.

Why do people keep perpetuating this myth? We're talking about an OS that runs on dozens of different architectures. Sure, people complain about "stable" being too far behind the power curve, but nothing's stopping you from moving to the "unstable" branch. There's a huge developer community supporting *BSD...errrr...ummm...

Oh damn, did the parent say Microsoft? That's different. Everyone knows that Microsoft is dying. ;-)

Re:When will someone use this to their advantage?

[King_TJ]

This sort of thing already came up with the last couple rounds of email-borne virii.

It's not necessarily such a great idea, because among other things, one mistake/bug/oversight in the "patch" - and you could start doing damage as bad as or worse than the virus you're attempting to remove. By definition, this "virus fix" would have to be treated as a virus by the anti-virus software authors too. (If it's making changes to PCs without their owners' permission, no matter what the motive, it's viral code, by definition.)

Depending on how "on top of things" the virus author is, there's also a possibility of a new variant being released that would respond in a very nasty way to attempts to disinfect via the circulating "patch".

Re:When will someone use this to their advantage?

[Anonymous Coward]

Whoa there baby... lest you forget what happened with Blaster last year? Someone wrote Welchia - which had a _very very very agressive_ ICMP scanning technique which brought many networks to its knees.

The univerisity I work at still has ICMP disabled because of Welchia.

Nimda

[tepples]

I'm sure if the file you sent out was called "thisvirusisnamedJim.vbs", it would be called Jim.

Tell that to the author of Nimda, the first major worm to spread multiple ways. He clearly named his worm "Concept Virus(CV) V.5, Copyright(C)2001 R.P.China" in a string in the binary, but the antivirus people called it "Nimda" anyway. Nimda 0.6 contained the string "Concept Virus(CV) V.6, Copyright(C)2001, (This's CV, No Nimda)" but it was still called Nimda.

Re:Nimda

[Bombcar]

Heh. I guess it was because he picked a sucky name.

Now if had been "AnthraXXX III V.6, Copyright(C)2001 R.P.China" it would obviously been known as "Sugar."

Re:Nimda

[nuckfuts]

He clearly named his worm "Concept Virus(CV) V.5, Copyright(C)2001 R.P.China" in a string in the binary, but the antivirus people called it "Nimda" anyway.

Maybe that's because the name Concept Virus was already taken.

The original Concept Virus was a significant milestone - the first virus written to infect MS-Word documents (using Word's own macro language - thanks Microsoft, we really need all that capability in a word processor). It was the start of an era where macro viruses became the most prevalent method of virus transmission on the planet, surpassing boot sector viruses (remember floppy diskettes?) and other formerly common methods.

Re:Nimda

[tepples]

Given that "Concept" was taken, if I were in charge of officially naming worms, I would have called Nimda "ChinaConcept".

Re:Nimda

[Cynikal]

"Maybe that's because the name [..] was already taken.

thats too bad :(, i SO wanted to release a virus named linux.vbs and watch the heated exchanges on slashdot burn a hole out of the bottom of my monitor :D

Re:Nimda

[sik0fewl]

Well, you could call it UnitedLinux. I hear that one's free.

No, NOT a Virus, just a scanner/cleaner

[billstewart]

This isn't the kind of job you want to do virally - you can do it just as effectively with a standalone scanner and a separate payload that blocks the ports but doesn't go doing its own scanning. That way, sysadmins and ISPs who want to run it can run it, but it won't clog up their networks with exponentially exploding quantities of probes, and people can block 3127 at their firewalls and run the scanner inside, which is a much safer network load. Depending on how heavily infected your network is, scanning and blocking a few thousand machines doesn't take very long.

This scales particularly well for this application, because the big source of infections was Outlook, which is used in corporate email environments, so corporate firewalls are the right boundary. There's probably some amount of Outlook Express infection, which is a problem for consumer-oriented ISPs, but it's mostly a corporate problem.
Also, running the thing as a sysadmin-controlled port scanner means that you can tailor the payload to pop up a dialog box saying "Hey, Stupid, You clicked on the MyDoom Virus and got yourself infected, call the Help Desk at 1-555-555-31337 to get your machine cleaned up"

Re:No, NOT a Virus, just a scanner/cleaner

[The Man]

Also, running the thing as a sysadmin-controlled port scanner means that you can tailor the payload to pop up a dialog box saying "Hey, Stupid, You clicked on the MyDoom Virus and got yourself infected, call the Help Desk at 1-555-555-31337 to get your machine cleaned up"

Or better yet, a popup message that says "Hey, Stupid, You clicked on the MyDoom Virus and got yourself infected, call Human Resources at 1-555-IM-FIRED to arrange your exit interview and turn in your cardkey and laptop."

YourDoom is MyDoom

[Anonymous Coward]

"And in international news, a new virus called W32.thisvirus.A@mm is infecting it's way through email. . ."

That sad part is..

[JPriest]

That it is just going right past AV programs just like A, B, and every other mass mailing worm before it. Give it a few days for people to update AV progies and maybe then it they will detect the virus. What a false sense of security.

We can't give users restricted accounts becasue it stops them from doing things like installing valid software. But don't you think it is time we took steps to sandbox the email applications?

Re:That sad part is..

[Mipmap]

I think the next "duh" security step for non-techies is to close up ports on their router, or if they don't have one (god forbid) on their ZoneAlarm installations.

What's needed for most folks beyond e-mail (25 and 110), web (80 and 443), and dns (53)?

Here's my router's log tonight. Log at all the 3127 hits. There's also a 3128 hit in there, surely a variant trying to side step someone closing a single port.

Monday, February 09, 2004 12:50:06 PM Unrecognized access from 68.94.18.241:3677 to TCP port 3127
Monday, February 09, 2004 12:50:09 PM Unrecognized access from 68.94.18.241:3677 to TCP port 3127
Monday, February 09, 2004 12:50:15 PM Unrecognized access from 68.94.18.241:3677 to TCP port 3127
Monday, February 09, 2004 12:55:13 PM Unrecognized access from 4.47.238.39:2458 to TCP port 445
Monday, February 09, 2004 12:55:16 PM Unrecognized access from 4.47.238.39:2458 to TCP port 445
Monday, February 09, 2004 12:55:24 PM Unrecognized access from 4.47.238.39:2458 to TCP port 445
Monday, February 09, 2004 12:57:56 PM Unrecognized access from 212.0.203.24:1031 to UDP port 137
Monday, February 09, 2004 12:58:12 PM Unrecognized access from 67.3.162.172:1945 to TCP port 3127
Monday, February 09, 2004 12:58:15 PM Unrecognized access from 67.3.162.172:1945 to TCP port 3127
Monday, February 09, 2004 12:58:21 PM Unrecognized access from 67.3.162.172:1945 to TCP port 3127
Monday, February 09, 2004 1:13:40 PM Unrecognized access from 151.199.43.246:1314 to UDP port 137
Monday, February 09, 2004 1:16:44 PM Unrecognized access from 200.174.67.136:4059 to TCP port 3127
Monday, February 09, 2004 1:16:47 PM Unrecognized access from 200.174.67.136:4059 to TCP port 3127
Monday, February 09, 2004 1:18:18 PM Unrecognized access from 81.7.107.247:3070 to TCP port 3127
Monday, February 09, 2004 1:18:21 PM Unrecognized access from 81.7.107.247:3070 to TCP port 3127
Monday, February 09, 2004 1:18:26 PM Unrecognized access from 81.7.107.247:3374 to TCP port 3128
Monday, February 09, 2004 1:18:34 PM Unrecognized access from 81.7.107.247:3691 to TCP port 1080
Monday, February 09, 2004 1:18:37 PM Unrecognized access from 81.7.107.247:3691 to TCP port 1080
Monday, February 09, 2004 1:21:41 PM Unrecognized access from 61.223.128.16:3169 to TCP port 445
Monday, February 09, 2004 1:21:44 PM Unrecognized access from 61.223.128.16:3169 to TCP port 445
Monday, February 09, 2004 1:21:50 PM Unrecognized access from 61.223.128.16:3169 to TCP port 445
Monday, February 09, 2004 1:24:28 PM Unrecognized access from 81.219.64.138:46674 to TCP port 1214
Monday, February 09, 2004 1:24:31 PM Unrecognized access from 81.219.64.138:46674 to TCP port 1214
Monday, February 09, 2004 1:24:37 PM Unrecognized access from 81.219.64.138:46674 to TCP port 1214
Monday, February 09, 2004 1:27:37 PM Unrecognized access from 151.199.40.13:1634 to TCP port 445
Monday, February 09, 2004 1:27:40 PM Unrecognized access from 151.199.40.13:1634 to TCP port 445
Monday, February 09, 2004 1:27:46 PM Unrecognized access from 151.199.40.13:1634 to TCP port 445
Monday, February 09, 2004 1:28:16 PM Unrecognized access from 80.2.66.105:3994 to TCP port 3127
Monday, February 09, 2004 1:28:19 PM Unrecognized access from 80.2.66.105:3994 to TCP port 3127
Monday, February 09, 2004 1:28:25 PM Unrecognized access from 80.2.66.105:3994 to TCP port 3127

Re:That sad part is..

[JPriest]

If they are running a router the ports are already "closed" unless they configured the machine into the DMZ.

Re:That sad part is..

[Anonymous Coward]

I get port 1080 on my mac too, as far as I remember its the famous proxy port?

Re:When will someone use this to their advantage?

[bluGill]

Well, I've seen it reveresed engineered, so you should be able to do that too. Really easy, Wine runs it just fine, and gives you some powerful debuggers and logging tools to help. (Make sure this machine is firewalled off though so you don't contribute to the DOS attacks in progress)

I'm not going into farther detail because if I did tell you how (which I can't because I've forgotten the details, but we figured them out so you can too) and you were a script kiddie it would be trivial to write whatever program you want and cause more trouble. An honest hacker would have no problem getting the details, so I can safely assume that you wouldn't write this anyway so you don't need to know. (Either you are too lazy to do it, or you don't know how)

MyDoom.A source code

[Anonymous Coward]

Doesn't "Andy" realize that by including the source code to MyDoom.A, he also helps the cops track him down? It's almost like writing a blackmail with a pencil instead of letters from various news papers... His coding style is included in the source code which the police is now of course very happy about.

Re:MyDoom.A source code

[timmarhy]

can coding style be used as evidence like hand writing samples?

Re:MyDoom.A source code

[Anonymous Coward]

Don't know, but it will definitely reveal something about the programmer. In this case, he definitely appears to be a linux/unix programmer. The sources were compressed with bzip2 and the coding style is linux/unix coding style. SCO's gonna love this.

Re:MyDoom.A source code

[Anonymous Coward]

Well, the writer has used Unix naming conventions for functions and variables, has used bzip2 compression for the source code and has distributed the source.

It certainly doesn't look like your average Windows coder's work.

I doubt they will catch who did it though

Re:MyDoom.A source code

[fred87]

Looks like linux/unix because of bz2. However, someone who would write something like this, if they thought the coding/indentation style could be used as evidence, would use indent (1)

Interesting article about malware

[inode_buddha]

was posted right here a while back. Googling for SubSeven and disassembly turned it up.

ISP firewalls vs. End-User or Company firewalls

[billstewart]

For a company/university/personal firewall, yes, it should usually be blocking any inbound traffic that's not understood. ISPs have a much different type of user base - they should be allowing the end-to-end Internet to work, staying open to any protocols that they don't have a very good reason to block. Temporarily blocking 3127 or 1434 or whatever is often necessary if there's a big outbreak, and there are some ISPs that restrict Port 25 because they're trying to prevent their users from spamming - but as a home Linux user, I find that rude and wouldn't use such an ISP for normal activities.

Re:ISP firewalls vs. End-User or Company firewalls

[grub]

ISPs have a much different type of user base - they should be allowing the end-to-end Internet to work

Oh I agree 100%, however the way the question was posed made it sound like he was an admin of a small/midsized LAN.

I would hope ISPs have rules on paper for this sort of thing, not "let's ask Slashdot!" :))

Re:ISP firewalls vs. End-User or Company firewalls

[zerocool^]

From the other end of the spectrum (mail administrator, not specifically of an ISP), I can tell you that there are very good arguements for limiting port 25. I'll get to that in a minute.

What I wouldn't do is what some of the apartment-wide ethernet services do around here: either block or limit EVERYTHING that's p2p or ftp or whatever. For a while, it was rumored that one of them had incomming port 21 blocked. That's bad practice.

But, blocking port 25 is a perfectly legitimate idea. First, because you should never run a mail exchange on a dhcp (or any dynamic) address. Second, the ISP's SMTP server is there for the express purpose of sending your mail. Just accept it and use it for it's intended purpose. Now, it doesn't stop you from sending spam, but what it does do is make sure that if you do, there's logs showing that it was you that did it.

~Wx

Macs are feeling it, too

[Undefined Parameter]

I own two Macs, so don't take this as a troll, please.

Right now, Macs are feeling the effects of this virus, too; it's slowing down internet connections for ALL platforms thanks to the fact that it's indiscriminately flooding networks with "noise" in trying to find other machines with the MyDoom-opened port. To my knowledge, it doesn't stop searching, either.

And a "counter-virus" would only make things worse. Sure, you eventually stop the original worm(s), but you also do more damage and risk opening up a can of worms in doing so. Not only is YOUR "counter-virus" going to add to the network congestion, but it may well become a problem itself if it's not written just right. In other words, the cure might be worse than the disease.

For the short term, we need an education campaign. Teach the standard (and sub-standard) users of the world how to identify a virus, how to prevent getting infected, and why they should care. As the old saying goes, "you can give a man a fish, and feed him for a day, or you can teach a man to fish and feed him for a lifetime."

~UP

Re:Macs are feeling it, too

[mlk]

Nah, stupidity tax will fix this problem.

One computer for each virus you help spread.

Re:Macs are feeling it, too

[inode_buddha]

Yer not trolling at all; I'm going through the same thing with my linux boxes. All these bounce mails with some weird MS exe file in them, WTF am I going to do with an exe? So basically, I sympathize and agree. And I *know* I'll be getting a few calls in the AM from my favorite users...

Re:Macs are feeling it, too

[tievape]

As the old saying goes, "you can give a man a fish, and feed him for a day, or you can teach a man to fish and feed him for a lifetime."

I've always preferred, "You can light a man a fire and warm him for a while, or you can light a man on fire and warm him for a lifetime."

Oh, well. To each his own.

Re:Macs are feeling it, too

[anthonyrcalgary]

Well... It doesn't need to be a worm to wipe out most of the infected computers. If your goal is to disinfect machines and remove the vulnerability, a few machines would be sufficient. It wouldn't be as fast as a worm, and it would be easier to trace, but all you'd really need to do is scan the entire address space several times per day for a few days. That's practical for a few computers on broadband connections.

Not that I would condone that. The person who did something like that would be responsible for any problems the "solution" caused, ethically and legally. And with a group of machines that large, there would be problems. I'm just saying it doesn't necessarily involve self-replicating code.

Re:Macs are feeling it, too

[Anonymous Coward]

And a "counter-virus" would only make things worse. Sure, you eventually stop the original worm(s), but you also do more damage and risk opening up a can of worms in doing so.

You don't need a counter 'virus'. You need a program which passively listens, and then patches the user's system on their behalf. The only systems you will patch are the infected ones which are actively attacking you.

Patching them (via backdoor/exploit) won't increase traffic. It will decrease it. The small amount of traffic you send to their system shuts off their large flow of traffic. When systems stop attacking you, you're not generating traffic.

Comment removed

[account_deleted]

Comment removed based on user account deletion

It's an open source virus!

[tepples]

Doomjuice distributes source code for MyDoom.A

Making this one of the first high-profile open-source viruses?

<zealot cause="BSD">The first being a license rather than a piece of software, namely the GNU General Public Virus.</zealot>

Re:It's an open source virus!

[Anonymous Coward]

Can someone post the source or a link - I've opened port 3127 to try and grab a copy, but no activity so far...

Re:It's an open source virus!

[Anonymous Coward]

Now here comes the real doom... Source will be in hands of all those script kiddie lamers.

Bah...

Did anybody else read that title...

[Art Tatum]

...and think that the source to Doom III had been leaked?

Re:Did anybody else read that title...

[Anonymous Coward]

No, but the source to MyDoom has.

Comment removed

[account_deleted]

Comment removed based on user account deletion

It is spreading the sources!

[Mayfoev]

Unfortunately, this sequel of the worm is spreading the sources, too... There are some ironic commentaries in the code like: What's the bug about "75% failures"? and even a readme file indicating that it can't be compiled under MSVC .NET

Re:It is spreading the sources!

[jrumney]

It sounds like they are playing up to the media FUD about open source extremists being responsible for the virus. Since they only did this after the media reports, I think we can assume that they are only releasing the source because they think they've hit on a good diversion. Unfortunately I think the diversion will continue to work as far as mainstream media is concerned.

Silly moderation...

[ralian]

How is the parent post offtopic? I found it interesting and relevant..

No, it's an "open sores" virus

[yerricde]

No, Doomjuice is an open sores virus, as it utilizes an open sore (that is, port 3127) left by MyDoom.A to get in.

Re:No, it's an "open sores" virus

[Anonymous Coward]

No, Doomjuice is an open sores virus, as it utilizes an open sore (that is, port 3127) left by MyDoom.A to get in.

C'mon, give this guy a (Score:5, Funny)! LOL.

eternal return

[veg_all]

I was fascinated by the zombifying worms, spreading across the internet making unsuspecting hosts into proxy spam servers, but now I'm beginning to wonder if worm harvesters will have to be written and (by mutual agreement) released onto the net. I still get code red droping by all the time (it can have my default.ida, for all I care; I'm through with it), and new kiddies write them at such an increasing pace that one New York Times article about worms recently needed two slashdot articles by the time it was posted. Might they start (at some point in the future) to actually start to "clog" the internet? Hell, they already do; the network where I work was brought to a crawl more than once over the last year because of them (and the idiots who administer the network, but that's another rant). Anyway, when worms constitute more than 50% of the traffic more than 50% of the time, some regulatory body is going to propose spidering worm-eaters. It'll be like "core wars" all over again (everything comes full circle sooner or later).

Re:eternal return

[kubrick]

one New York Times article about worms recently needed two slashdot articles by the time it was posted.

Hey, you've been around Slashdot for a while... you should know by now that whether or not an issue needs more than one article, there will invariably be a dupe anyway. :)

Re:When will someone use this to their advantage?

[laugau]

The MyDoom API is documented in RFC 3128. You can also look at the javadocs. It's all in there.

Re:MyDukeNukem

[hlopez]

At least we are years away from MyDuke.nukem.forever. This will give al the anti-virus companies a chance to prepare, althogh it will be a primitive virus, obsolete before it comes out.

Wonderful

[ngyahloon]

A Microsoft spokesman said Monday that any performance problems on the company's site are likely related to countermeasures the company took to evade the MyDoom.B DDoS attack and not an attack from machines infected with the latest variant."

So in other words, to prevent MyDoom from DDoSing Microsoft's website, Microsoft decides to DDoS themselves instead. What a wonderful world!

Re:Wonderful

[Anonymous Coward]

I don't think an inside job really counts as a *Distributed* Denial of Service.

Re:Wonderful

[Cynikal]

Heh, makes me wonder if the servers are being hosted by the french... "oh no, they're comming, everyone fall down and surrender!"

- relax, i can say these things because im part french

Re:Wonderful

[Nex]

So for once you're right? Nex

(relaxe mon vieux, c'est de l'humour)

+5 UNINFORMED, YET WILLING TO WHINE!!

[bsd troll]

Re:Dumbass alert

[laugau]

If (you == girl) {
_never_had_boyfriend(you);
} else {
never_had_girlfriend(you);
}

Head Explodes MS Security report by Gartner

[bstadil]

The mind buggles. Today Gartner published a report trying to tell the world that Microsoft's Security is improving.

interesting point....

[caino59]

indeed.

and another point why internet voting just wont work...how many machines have other backdoors on them aside from this mydoom crap....i'm willing to say that's the number is more than that infected by mydoom alone.

See, when you distibute the source...

[Ghengis]

you make MacAffe's and Norton's work easy. This time, they only had to edit someone else's virus to keep themselves in business. Seriously, though, haven't you ever wondered if they pay to have some of these things written so that they can make money off of the ensuing paranoia?

Re:See, when you distibute the source...

[Anonymous Coward]

No, they've got way too much at stake.

Re:See, when you distibute the source...

[Anonymous Coward]

I disagree....(with the "No" part, there's obviously a lot at steak..)

If I wanted to be a thief...I'd join the cops..
If I wanted to be a smuggler...I'd join customs.
If I'd wanted to be a virus writer...I'd join an anti-virus company.

If I'd wanted to be a dictator....I'd make sure I was "elected"......

Re:Dumbass alert

[Anonymous Coward]

This isn't flamebait, it's insightful. All these viruses are spread entirely through complete and utter stupidity.

We need to start blocking these fucking retards off the internet until they grow a brain.

Re:None for me

[Anonymous Coward]

the do as I did, use an outlook express rule to "delete from server" then you never get to see them, better than a client side rule.

cheers

crap

[MisterFancypants]

First Half Life 2, now the C source of Doom 3 is out in the wild... Damn, now we'll never see these games.

Obligatory Profit! joke

[gxv]

Spammer:
1. Spread a virus opening backdoor in infected systems
2. Send spam trough these backdoors
3. ....
4. Profit!

Geek:
1. Spread a virus opening backdoor in infected systems
2. Install seti@home clients trough these backdoors
3...
4. Fun!

Odd virus target choices

[Anonymous Coward]

It seems to me that there should be more viruses that target offshoring and tech visa organizations. Not that I condone such, but if the attacks reflect issues that piss off techies in general, then a dying IT market should rank right up there.

McAfee is reporting over 63k viruses...

[jackb_guppy]

So any bets WHEN the 2^16 (65536th) virus will be found?

Re:Dumbass alert

[ePINOY]

But it said "I love you!" !!! ;)

Re:None for me

[Anonymous Coward]

I use popfile.. i dont do automatic deletion for anything, even viruses.. in order for popfile to filter it, it has to download it

Source code!

[Anonymous Coward]

Anyone have a copy of the source code? (Probably some of you out there with infected machines ;) The file is sync-src-1.00.tbz Can someone mirror it? Thanks!

Port 25

[RT Alec]

Actualy, if more ISPs blocked egress port 25 traffic, these types of viruses (that use their own SMTP engine) would not have been an issue in the first place. Leaving port 25 open is a bad idea for ISPs, and a bad idea for businesses that have computers on the internet.

Re:Port 25

[groomed]

Haven't you denial-of-information-service people learned a damned thing? If port 25 is blocked, we'd just get SMTP-over-HTTP within 6 months.

Re:Port 25

[RT Alec]

Haven't you denial-of-information-service people

I certainly don't wish to deny information. Mail servers on consumer level accounts simply cause too many problems. For every properly functioning mail server behind a dialup/cable modem/residential DSL, there are 100s, if not 1000s of improperly configured servers, with almost no accountability. I am referring primarily to infected Windows machines, that like it or not, act like a mail server. Then there are the casual hobbyists that test Exchange wide open because they don't know any better, or the home user that installs WinGate and becomes an unwitting haven for spammers.

If you want to run a mail server, at least get a static IP so you can be held accountable for any improper use of the Internet you might engage in (providing a resource for spammers is considered improper).

If port 25 is blocked, we'd just get SMTP-over-HTTP

I'm not sure what you mean by that. For e-mail to be recieved, it eventualy arrives at the recipient's SMTP server on port 25. That is what I advocate blocking-- port 25 traffic from residential accounts. It does not matter if the message floats around the Internet on various ports, what matters is that infected Windows machines cannot directly connect to SMTP servers via port 25.

Re:Port 25

[TarpaKungs]

I certainly don't wish to deny information. Mail servers on consumer level accounts simply cause too many problems. For every properly functioning mail server behind a dialup/cable modem/residential DSL, there are 100s, if not 1000s of improperly configured servers, with almost no accountability. I am referring primarily to infected Windows machines, that like it or not, act like a mail server. Then there are the casual hobbyists that test Exchange wide open because they don't know any better, or the home user that installs WinGate and becomes an unwitting haven for spammers.

Well, I run a well configured MTA on a residential DSL line. That's why I chose a high class ISP who will never block ports. I do that on *my* firewall. If there clueless people who run Windows and can't be arsed to learn how maintain their machine (do they maintain their car??), then kick them off the internet completely until they can a) learn how to look after a flakey piece of crap written by MicroSoft - or b) use a proper OS - and learn how to look after it. I would seriously object to my resonisble access to the Internet being messed up because of people who can't be bothered... I have the same lack of respect for these people as I do for some stupid fool in a car who can't be bothered to drive properly. In his case, (s)he stands a chance of being nicked by a copper and banned.

If you want to run a mail server, at least get a static IP so you can be held accountable for any improper use of the Internet you might engage in (providing a resource for spammers is considered improper).

To a degree this is a reasonable point. But there are linux folks I know who know what they are doing, but have only Cable with no choice of a static IP. Tey had to make do with dyndns. Why should they suffer?

Re:Port 25

[Alioth]

What ISPs need to offer really is two services.

The default service results in a connection that's firewalled from incoming data, and port 25 outbound is filtered.

If the user checks the box "I don't want to have your firewall" they get a normal end-to-end connection.

Also, dynamic IPs on 'always on' services is lunacy. Everyone should get a static IP by default. That way people would have more accountability (and I can block troublemakers from my server much more easily).

I use Spamhaus's XBL (Exploits Blacklist) which lists exploited systems sending spam. 99% of my Exim reject log is cable/DSL/dialup IP addresses being blocked by the XBL. Exploited home Windows systems is a very big problem.

Re:Port 25

[stridebird]

I'm not sure what you mean by that. For e-mail to be recieved, it eventualy arrives at the recipient's SMTP server on port 25.

No, you are not sure. In that respect, you are correct. In other respects, you have got your underpants on your head mate.

Recipients do not, generally, have a SMTP server.

For email to be transferred it is sent from a client to an MTA (mail transfer agent). The MTA will either, depending on the routing path, deliver it to another MTA or to the recipient mailbox. When you log on to receive mail you do not connect using SMTP (port 25) - you connect using IMAP or POP3 or some such. When you send email you will need to be able to access port 25 on a remote machine - the MTA. As a residential user typically you should only be able to access your ISP's MTA and this server will transfer your email on to the wider net.

I have used a dozen odd ISPs over the last year and in all cases, access to the MTA was blocked from anywhere except within their networks - ie with an IP address from one of their blocks. The only open relay I have stumbled across in the last 2 years was in a British University - which is traditional, I believe.

Re:Port 25

[weave]

If port 25 is blocked, we'd just get SMTP-over-HTTP within 6 months.

Great timing on this post (for me). I just got done reading how Microsoft has implemented RPC over HTTP in Exchange Server 2003. What next? Redirect ports 137-139 and 445 over HTTP to allow file sharing through corporate firewalls? :(

Re:Port 25

[RT Alec]

you have got your underpants on your head mate

I do not wear, not have I ever worn, underpants on my head. You are incorrect on that point.

Recipients do not, generally, have a SMTP server

Actualy, they do. I guess technicaly it's not theirs, but it is one they have been given access to (by their ISP, or by their business or other organization that runs a SMTP server). That's what should be receiving mail for them, and that's where the problem is if residential users infected with [fill in this week's virus] connect to. That's why so many SMTP servers block as many DHCP IPs as they know about. I do.

When you send email you will need to be able to access port 25 on a remote machine

Not if the admin of the remote SMTP server you wish to use as your MTA knows what they're doing. Part of the problem is that initial mail submission and mail transport both use port 25. I have configured my server to allow initial mail submission on an alternate port (465), and have SMTP+AUTH+SSL running on that port. My users connect via SSL and must use a password to send mail. They can do this from any ISP, even AOL.

Re:Dumbass alert

[petabyte]

I party blame Netscape and other email proggies that send forwards or replies as attachments rather than as inline quoted text

Yes, but you can turn that off. Evolution did that. Turning it off was one of the first things I did.

Educating the "general user" about virii has come a good way, but some people still need some lessons. Sadly, I think the great majority of users that still spread these viruses are simply negligent (they know better but really don't care). Maybe I'm too techsupport-bitter.

Re:MSN messenger? Yes....apparently

[Stonent1]

I've been having trouble connecting to it since the middle of last week. And I work for MS! So what's the official answer? Dunno, it's MSN's baby.

This just in...

[flamingweasel]

AV Software is a market created by the people who write the software. It provides only false security. I have never used antivirus software. Ever. Know how many viruses I've received in the last ten years? None. Here's my patent-pending method to keeping those evil hackers from putting their viruses on my computer.

1. Keep your computer patched
2. Don't be retarded
3. There is no step three.

Re:This just in...

[Anonymous Coward]

That was ausome.

Re:This just in...

[pantherace]

Having been on the internet since 1989 & never having used anti-virus that much (other people's computers might have it, or computers at labs). Nor has my account ever gotten a virus (detected them in other people's accounts, and killed them, but not personally had them)

Most important:
1. Don't be an idiot.
2. Kill Outlook Express or make sure it never gets run... (could be part of #1)
3. See parent poster
I recieve virii all the bloody time in email from idiots (for me it's worse than spam, yet still a very small amount...) YET they never run, because you had better believe that #1 covers running unsigned binary attachments from people you don't know...

Patent-pending? When were you first on the internet? (Comments about thinking all the money grubbing IP .commers were either broke or at amazon.com....or SCO)

Re:This just in...

[TrancePhreak]

How do you know you are not one of the zombie computers that was spoken of? AV software companies may not be as good as they used to be, but the software is hardly not needed. This is expecially the case if you use floppies from other people or download programs of any type and run them. There was a time when even stuff on Download.com was infected.

Re:This just in...

[Anonymous Coward]

um your ignorant. i get viruses all sorts of ways. ive had webpages in ie download "htm" files that are viruses. norton kills them. ive had bad files off kazaa soulseek dc napster ftp email bbs's edonkey icq newsgroups -- everything.

your obviously

a) a *nix only user
b) someone who doesnt ever visit any shady parts of the net
c) filled with a hundred trojans and keep having to reformat because yer puter aint werkin rite

or theres always d) not popular enough to get viruses.

Re:This just in...

[geschild]

Or, since you've never used any anti-virus software, you'r not aware that the machine has been infected by a virus... :-D

But yes, a little caution goes a long way, just don't expect it to save your back all the time. I've learned the hard way that every once in a while you're confronted with something you didn't know could be a problem and you're bitten.

Still, props for being so vigilant.

Re:This just in...

[root_42]

This sounds just like the firewall admin who said We never have been hacked or even been tried to be hacked. This guy will almost absolutely surely have missed some attacks and does not watch his logfiles.

How can you say that you never had a virus when you never used an AV-scanner? Some viruses may not be noticable when on your system.

Re:This just in...

[Cynikal]

um how did this get a +5? does anyone see the self defeating retardedness of the statement? "I have never used antivirus software. Ever. Know how many viruses I've received in the last ten years? None."...

just question.. how can you confirm that you have never recieved a virus if you never run an antivirus? so either you

a) dont have a computer (then all statements = true) or
b) you have your head up your ass (can i email you at your @micosoft.com work address?)

i have like a million analogies for this to put it in better perspective, but if you dont get my point by now, i dont *want* you to read/comment on my posts.

oh and if you think patches will protect you from all the virii out there, then buddy, you just broke rule #2... and here's a paper clip for that gaping wound.

Re:This just in...

[Cynikal]

i am so sorry, i should have read the other replies to this first, everyone seems to have said what i mean in one way or another.. but just in case, i did not take into acount that you may be using an obscure OS of some sort, or a trs-80, and if so then i offer a retraction on my comment.

Re:This just in...

[Anonymous Coward]

He *could* be using a plain tripwire you know.

That, and I have a similar policy. I know there's no virusses on my windows system purely because I only use official (paid for) software on it, the newest title from a year back, and none of the vendors have released statements saying they're infected. That and I don't use windows for accessing the internet at all.

Now tell me, how could I get a virus?

Re:This just in...

[Cynikal]

why dont you just leave it in the box then?

Re:This just in...

[Anonymous Coward]

Maybe he's an engineer designing mechanical parts on his computer.

You're obviously a luser messing around with warez all day long and not getting anything worthwhile accomplished in the end.

I'd rather see your computer in a box than his.

Re:This just in...

[acceptera]

I have never used antivirus software. Ever. Know how many viruses I've received in the last ten years? None.

How do you know that you haven't been infected if you haven't ever scanned your computer?
Some viruses aren't very harmful and might not be noticed.

Re:This just in...

[Anonymous Coward]

The only reason your getting away with this is because you dont NEED a virus checker to remove a virus anymore. If virus authors go back to actually getting their code to patch into your existing .com and .exe files to hide and run you will be screaming for a good antivirus prog to disenfect them. Or maybe you are from the age of real computers users where you removed all the infections with a hex editor by hand.

Re:This just in...

[NatasRevol]

Now tell me, how could I get a virus?

Floppy disk?

Re:This just in...

[zerocool^]

Exactly.

I used to do the same method of virus protection: Firewall, and don't be dumb, and keep things up to date.

I got viruses. Minor ones, but still. Know how? Someone on my internal house network (roommate? girlfriend?) got a virus and it spread. Even though I didn't click on anything - I just had a windows share open so that I could get to my south park episodes on the downstairs tv-computer.

Now? I have AV software installed. I don't keep it resident in memory, but about once a week, I go through and update it and scan everything, just to make sure.

~Will

Re:This just in...

[Lord Kano]

Ignorance truly is bliss huh?

Sounds to me an awful lot like the IV drug user who claims to never have gotten a disease because he always rinses his needles. Why get an AIDS or Hepatitis test if your needles are always clean?

I keep my machines patches, and I keep my AV up to date. My first virus infestation came from buying (not downloading), but buying shareware from a reputable company. Oddly enough, my first antivirus software came from these same people.

LK

Re:This just in...

[mpweasel]

figure out how to

4. Get this through people's thick skulls,

and you will surely

5. PROFIT!!!

Re:This just in...

[Shurhaian]

Back in my earlier(i.e. naive) computing days, I got hit with a Maltese Amoeba. The device never actually went active.

In that case, it would've been bad if it had, since it would've overwritten system files, but I got an antivirus before that happened.

Some other time, I got hit with an IP attack virus. Regular virus scanning caught it soon after, and though the virus itself didn't SEEM to do much(that I remember; it could've been a backdoor), that was around the time I got interested in firewalls.

Re:This just in...

[dcam]

You've just earnt yourself a foe. If there was another classifiction of idiot, I'd use that instead, but as all /. has to offer is foe I guess I'll have to use that.

Re:This just in...

[mysticalreaper]

flamingweasel, you rule. And you're right.

How do you know you're infected without AV to tell you?

This question has been posed by many here. And the answer is simple. You know if you've been infected by the collateral damage. The evidence. By the change in your system. Hard as this may be to believe, some of us would IMMEDIATELY notice large outbound traffic in the form of portscans, and thus the virus. Some of us would IMMEDIATELY notice a weird icon, a process not seen before, a general 'badness' abou the computer that was not there a day before. If you cannot observe the effects of a virus, how can you know it's there? Put another way, if you have a virus, and it does nothing, can you even say you've got a virus? And even if you DID have a virus, but it did nothing at all, what would be the harm? None.

So, for a virus to worth worrying about, it must be malicious, and harmful. These things are observable by normal, non-AV methods.

THEREFORE, one can exist, without AV, and be certain enough for one's own comfort (as nothing can be certain, even when you DO run AV) that you are not infected.

I personally was in the exact same position, and have several friends who also don't run AV, and yet, miraculously, haven't gotten a virus. Honest.

(Since that time, I've defected to linux, so now i'm even MORE cocky, but the logic is sound, and lasted me through 8 years of heavy windows use.)

Maybe one day

[andih8u]

Cable and DSL companies will give out a nice little hardware firewall ala Linksys or Netgear along with their cable/dsl modems. Hell, Toshiba even makes a cable modem with a built in 4 port switch/firewall. Giving these users a broadband connection and no education on the dangers of the internet is like giving a Ferrari to someone who can't drive.

I know the ISP isn't untimately responsible for their users actions, but they'd be doing themselves a big favor by eliminating most of that traffic. During the heyday of the Blaster virus I was getting a few port 53 requests per second from infected machines on Verizon's dsl...that's quite an additional load on their network.

Re:Maybe one day

[mobby_6kl]

I chose an Asus ADSL modem/router (sorry not in English) with my dsl service, it has built in firewall, ip filter and some more stuff. But they do give a choice and most users would probably chose another lame usb modem.

Re:Maybe one day

[glsunder]

They're going backwards. I got in on dsl in my town early and we got a cisco dsl router/modem for free for signing a one year contract. A year or so later they started giving out a crappy brand that wouldn't work with a freinds online games. Now, I don't think they even give users a router at all, just a modem, and expect them to use a software firewall. Yeah, like that's a good idea for people that can barely install the latest sims game, can't figure out how not to install gator every other week when browsing the web, and send every "funny" pic they find to everyone in their address book.

Re:Maybe one day

[liquidsin]

Every time this goes around I say the exact same thing. Would it be so difficult to hand out a modem/router combo? It wouldn't cost them anything more - the customers are paying for their hardware anyways (at least where I am, I pay a monthly "lease" fee with no opportunity to buy my own). Lock the thing down and have a web admin interface, accessible ONLY from the internal network. All ports closed by default. Anyone who needs to do anything more complex than surfing the web, checking email, and using IM should be able to figure it out - if you can't manage to open a service hole in your firewall, does the internet really *need* you to be running web/mail servers??

Re:Maybe one day

[ChartBoy]

Hargray Communications gives users a Linksys BEFSR11 router as part of their DSL package, at least on Hilton Head. This provides a little protection through NAT (although I installed a beefier BEFSX41 for the inlaws).

My suspicion is that they're doing this to make PPPoE configuration easier. If they can save bandwith or other support costs, they save money in the end. More should follow their lead.

How about.....

[rspress]

How about MyWindows.xp?

Actually Microsoft should be advertising the fact that it is the best OS on the planet for virus development and deployment. It would look good on the Windows vs Linux propaganda.

Why not use the MyDoom backdoor for virus removal?

[shellac]

Hey, I have a great idea. Why not use this open port on the infected MyDoom boxes to propogate a virus which is set to automatically remove MyDoom and then remove itself several days after infection? It would be a great way to "patch" all these compromised boxes.

That being said, I wonder what the legality of this benevolent virus would be. Could the author of the virus safely step forward and make his name known?

MyDaikatana

[t0ny]

I heard Romero has been working on the MyDaikatana.a worm for the past five years. Unfortunately, he released it into the wild and nobody noticed; it apparently couldnt spread.

Re:MyDaikatana

[Microlith]

It spread but kept killing it's complementary worms MyDaikatana.b and .c in the process with MyDaikatakana.d and .e constantly attacking.

It's not that no one noticed, it's that it was so braindead it killed itself!

Re:When will someone use this to their advantage?

[Fnkmaster]

Yeah, apparently certain IP addresses or subnets were on the Welchia slam list - a web site of mine got moved to a new IP address and I started seeing all sorts of weird HTTP traffic. Apparently the IP address I was moved to was on a Welchia list of some sort, and every two or three days lots and lots of Welchia infected hosts would send a packet my way. The result was about a thousand spurious connnections a day wasting a modest amount of bandwidth and totally screwing up our site statistics until we figured out how to block these particular requests.

it really makes you think...

[Anonymous Coward]

What if someone wrote a virus to target Macs? There are literally hundreds, if not thousands, of people using Mac's these days and many of them are connected to the Internet. A Mac virus of the MyDoom type could cause a pretty big problem somewhere like an art school or a large interior decorating firm. Just something to think about...

Re:it really makes you think...

[Anonymous Coward]

>>or a large interior decorating firm

hahaha. best laugh all day. i imagined dozens of Mr Humphreys all a-flutter.

(written by a non-interior decorating type with a G4)

Re:it really makes you think...

[MarcQuadra]

Well a Mac virus would probably need you to enter the admin password, which on any MANAGED system is unknown to the users. As for personal machines, I've found that the VAST majority of Mac OS X users DON'T KNOW their own password, as they've had auto-login turned on.

For a virus like this to work on a Mac it would have to either:

1. find a root exploit, and use it on a machione that Apple hasn't patched yet.

2. Get the user to mount a disk image, open an installer or binary, and enter an admin password to plant files in privileged areas or modify startup scripts. That's one DUMB user.

I'm not dissing Mac users, they're my bread and butter (I manage a 200 Mac network).

so is this why...

[Anonymous Coward]

msn has been down the better part of the day, or is it yet something else microsoft can't get right?

I like the idea...

[RoadkillBunny]

The verus writter (Andy) had a great and original idea with the viruses. He released 2 viruses whose only point was to spread as fast as they could and open a backdoor, with the smoke screen of DOSing MS and SCO, but no real damage to the computers. Now comes along C, I don't see it doing any damage other than slowing down internet, but imagine if it did. It can spread quite fast through the backdoor left by very fast first two viruses.

Re:Head Explodes MS Security report by Gartner

[vwjeff]

I'm no Microsoft supporter but you can not blame them for this one. Someone had to install a program (virus) to become infected. The spread of this virus and its variants are a result of ignorant computer users who happen to be on the Windows platform.

Blaster on the other hand was a result of a security flaw in Windows.

Well, I feel better already

[I_am_Syrinx]

It turns out the only scans for 3127 I'm getting are from my ISP. My firewall log shows they appear to be scanning all of 312x. At least I don't have to worry about securing my machine now. It looks like they've got it covered.

New MyDaikatana Release Date

[Eradicator2k3]

Hey guys, I just heard from a guy who got infected by the romero.a worm that MyDaikatana is supposed to make us its bitch in 2005. Although the romero.b, .c and .d variations claim the same thing for 2006, 2007 and 2008, respectively.

MOD PARENT FUNNY

[Anonymous Coward]

MOD PARENT FUNNY

MOD PARENT UP!

[LostCluster]

Netcraft is confirming this virus is having an impact on MS's website. However you feel about the company, that's news.

Re:Dumbass alert

[Anonymous Coward]

Anyone using the word virii should have their internet access revoked for being too damn stupid. Stop using madeup nonwords, morons!

Why Stop There?

[EXTomar]

Why is it just the individual user's responsibility for firewalling their system? Shouldn't ISP help a little by steping up and blocking some of the effect ports during these times of crisis? Why weren't more ISPs just outright refusing to send or accept traffice on port 53 during Blaster? Is it because *gasp* they and telecos get paid on bandwidth usage?!

Yes it is the individual user's repsonsiblity to keep their computer neat and tidy like one keeps their home and property tidy to prevent fires. However if a home does catch on fire you bet the city is going to step in if not to protect you but to protect other's property. Why are ISPs letting so many "fires" run rampant?

Re:Slashdot a SCO executive's home telephone numbe

[Anonymous Coward]

Why would an SCO exec be living on Front Street in Philly? BTW, does everyone still street race on Front Street? I haven't been there in over a decade.

Port 3127

[retro128]

What the submission missed, but is worth noting, is that port 3127 is one of the ports that MyDoom.A opens when it infects a machine. In other words, MyDoom.C is exploiting the hole that MyDoom.A opened.

The writeup from Symantec is here.

Re:Port 3127

[advocate_one]

so why can't windows update work this way???

MSN Messenger's back up.

[Mir322]

Some people were reporting lack of service in MSN messenger service. It seems msn messenger is back up. And that's with Kopete.

---

Re:Why not use the MyDoom backdoor for virus remov

[twistedcubic]

Anyone who writes this would probably be accused of writing the original virus. As an added bonus, if the writer is a U.S. citizen, the terrorist enhancement would apply, and this means he or she might accept a plea regardless of guilt.

sure

[Anonymous Coward]

but I'll have to look it up and that might take a couple days. I'd recommend checking this thread once or twice a day for the next couple weeks so you'll know when I've found it.

Re:Parasitic Viruses attacking My-Doom Infected Bo

[LittleBigLui]

Unlike MyDoom, which is exploiting Microsoft weaknesses, [...]

You misspelled "dumbasses". (MyDoom doesn't exploit software weaknesses but idiot users who click on everything that looks like it could make funny noises when clicked.)

Unix programmer

[Anonymous Coward]

If you have seen the source code, the programmer doesn't use the standard Windows (hungarian) notation. His coding style is more of a unix/linux programmer. Today SCO will use this as evidence that a linux programmer wrote the virus... There's a picture of parts of the code here if you don't have the source code.

Wow, a virus that updates itself over the network

[codemachine]

Next thing you know, we'll see this on Windows Update:

MyDoom.C - A critical update for the MyDoom virus is now available. This update fixes the flaw that prevented infected machines from launching DOS attacks at microsoft.com past the expiry date. Install this update if you need microsoft.com DOSing capabilities.

Cheap Routers at Futureshop

[Anonymous Coward]

There are $69.99 routers with firewalls at Futureshop. There is no excuse for people to have any IP ports just open. It's getting stupid.

Spend the money.....

i can see it now ...

[LittleBigLui]

If it's making changes to PCs without their owners' permission, no matter what the motive, it's viral code, by definition.

Subject: Clickety-click!

Attachment:clickety.exe

Text:

Yeah, you know, the files you axed me for.

<SmallerFont>
By starting the attached file, you agree to: A) have remote administration software installed on your computer, B) allow that remote administration software to replicate to other computers as well, C) have a mail relay installed on your computer, D) have software that might conflict with the remote administration software (e.g. anti-virus software) disabled, E) you're not reading this anymore, are you? F) have updates to the remote administration software automatically installed, G) this text is so boring, H) even if that updates fundamentally alter the functionality of the software (e.g. DDOS the shit out of macrohard.com or dashslot.org) I) why not check out the nice file i sent you instead. J) you agree to never sue the author or distributor of this remote administration software for anything. K) no, really. the file is so nice - maybe it even makes funny sounds when you click it? L) neither anyone who uses your computer to send electronic mail, no matter what quantity or content.
</SmallerFont>


We all know, nobody reads those EULAs :)

Give a man a...

[darekana]

"you can give a man a fish, and feed him for a day, or you can teach a man to fish and feed him for a lifetime."

..."or you can give him a drift-net and he can wipe out all the frickin fish in the ocean... and then complain about all the fish being gone."
(probably closer to what we've got here)

The ULTIMATE Vaporware Virus

[rock_climbing_guy]

Here is the ultimate Vaporware Virus:

MyDukeNukeMForever.A

Re:The ULTIMATE Vaporware Virus

[Anonymous Coward]

It's NOT vaporware! It will be released WHEN IT'S DONE. We just had to change the virus engine from vbs to C#.NET, but it's going to be the best virus EVER. Full freedom for the user: want to send the virus to your mother, your cousin, your boss, or some random loser on /.? With MyDukeNukeMForever.A, this will not only be possible, but it'll be reality! It's going to revolutionise the way people think about viruses.

Oh, and it'll have full 256 colour VGA!

Re:The ULTIMATE Vaporware Virus

[Anonymous Coward]

And the name it will be assigned....
Darkmeteor

"Today the computer virus known as that no one is really using C.NET anymore. It must ahve taken the writer 5 or more years to compose this thing, and the world has since been using...."

Actually, Mydoom.C does give you the source :-)

[CrystalFalcon]

From Internet Storm Center (emphasis mine):

A new worm, named Doomjuice and MyDoom.C by various AV vendors, was identified. It spreads by exploiting the backdoor left by MyDoom.A and MyDoom.B. After infecting a system, it leaves a copy of the Mydoom.A source in a file named 'sync-src-1.00.tbz'. Doomjuice is also set to perform a DDOS against www.microsoft.com.

Re:Actually, Mydoom.C does give you the source :-)

[gnu-generation-one]

"Doomjuice is also set to perform a DDOS against www.microsoft.com."

So by the reasoning of the popular media, this one must have been written by the US Justice Department, because it attacks microsoft?

Re:Actually, Mydoom.C does give you the source :-)

[Anonymous Coward]

Mod this down. This isn't "interesting" it's flamebait.

Re:Actually, Mydoom.C does give you the source :-)

[Anonymous Coward]

Got a mirror of the source?

Re:Actually, Mydoom.C does give you the source :-)

[neko9]

that sync-src-1.00.tbz file is already on donkey network. how fun.

Re:Actually, Mydoom.C does give you the source :-)

[Ungrounded Lightning]

Mod this down. This isn't "interesting" it's flamebait.

I agree that "interesting" was wrong, but not that "flamebate" is appropriate. To me it looks like a "funny" - and the emoticon suggests that's what the author intended.

We have

[krray]

Their called Mac's. Oh, sure, there's some Linux workstations peppered about. Mostly for the zealots, but of course some test beds with the neophite type users.

The ONLY thing that Win2K anymore is ... AutoCAD (which is the only version of Windows left deployed -- 98se is gone, WFW3.11 is long gone and XP never saw the light of day thank goodness!)

Ironically I've been more than happy to supply feedback to AutoDesk with regards to their OS X flavored version in development. Started on the Mac, may end up back there again. YEAH!

Otherwise -- we're seriously exploring all alternatives for 3D CAD residential and commercial building, surveying, and landscaping type design which is where the majority of my clients needs fall. Some mechanical which were are the first to want to play with the Linux (old Windows boxes :) and Mac's as available.

Heck, the network have been segmented, physically and logically at the switches in the computer rooms. "Windows" and "Everybody else". When traffic goes nuts (somebody brought a virus riddled laptop in and hit the network somewhere) -- the switches will auto-shutdown the Windows segments. I've even happily supplied network jacks at open desks, lunch room, break rooms, warehouse, etc -- they all go to a secondary (yet sub-segmented) switch bank.

ISP complaints when it _does_ happen inside? -0- the problem can take care of itself. On a lower level I've done the same thing at home with a little help from, what is it this year?, iptables (I was still thinking chains and miss just fw :). Go ahead and bring your [Windows] laptop in -- here's a port. Virus infected won't even touch the ISP much less my Linux boxes, Powerbook [wife ;], or the beloved PowerMac. Great for testing before rolling it out anywhere... :)

Word Processing, Spreadsheets, pick a graphic format, pick a video format, pick a sound format -- put it all together and mix it up a bit ... you pretty much come up with iLife. [no, i do NOT work for Apple, I just happen to also dig my iPod ;*]

Bah, Microsoft.

Re:We have

[Anonymous Coward]

I do have to admit I am impressed with what Apple has done with UNIX and the rate at which they are improving OSX. I don't own an Apple yet but they definately have my attention.

Re:We have

[Anonymous Coward]

Good -- and I'm glad they do. They sure got mine with everything I read about OS X. Yeah, you had to buy the beta. And then pay again. Then they'll charge you for the upgrade. But it's cheaper than Microsoft in the end...

I come from a time, way back when -- in '69 ... you could see over the horizon and see that Unix was going to be your friend.

AT&T SysV4. Unix that it is. In the proper format, context, naming, copyright holder, and patent generator as the best as I can tell and recollect or otherwise state that I'd have plead the 5th. The 3b15 was a monster big machine. Stand two tall refrigerators side by side and you'd come close in size. 48, then 60 serial ports, wires all around. The ISN multiplexor was a thing of amazement (predecessor to ISDN, by ... AT&T and wiring/computing our campus :). 60 cables reduced to a dozen.

Then ethernet and TCP/IP. I remember when 128K was considered broadband and enough to feed ... 5,000 students. Today the wife and I eat up 10Mbit the broadband uplink (!) TCP/IP I believe was developed on one of the Unix's. The web was created on a ... NeXT (predates OS X :).

The hardware isn't expensive. Go put together a GOOD top notch PC. Putting all the right video cards, memory chips, hard drives, etc -- you'll be building a PC trapped ... Mac. Actually my SCSI-320's, a couple IDE's, DVD burners, memory chips -- pretty much everything short of the Mac w/ video (bare everything else) originated on a PC. In use on the Mac.

Stupid programs that I wrote on the 3b2 I still use today. The 3b2 was about the size of 2x2x2 toaster ovens and I had a 486 when 386's were the talk and 8088's where replacing 8086's on the streets. Still use them (recompiled of course -- ooohhhhh :) on the Linux [servers] here and there. Still use them today on the OS X running Darwin V7.2.0. Interesting that it takes so little to get Linux, BSD, OS X, a Solaris, or even my 'ol Coherent box to talk and play nice.

Who's the troubled kid on the block. Bill's a nerd. A rich nerd. But a nerd. Steve (Jobs) is the geek and doing a pretty good job at it. Sure, OS X has it's problems and there's some things I look at Apple and say WTF! (a one button mouse ... PLEASE). It's a HELL of a lot better than ANYTHING Microsoft has EVER put out -- and brings back fond memories of my NeXT days at yet another University. Ok, so the nerd won. Revenge of the nerds. Yeah. I sure wish Bill would just say F U to the world, close Microsoft -- and let the Unix's take it to the next level.

I'm still speechless over the whole SCO thing. Between laughs of course.

Think VERY CAREFULLY about the next computer you buy. Worst case (it won't happen :) is that Apple dies, OS X is virus infected. You take LinuxPPC and roll on. NeXT.

Re:Dumbass alert

[zurab]

How many times can you tell people never to open attachments until you just give up and accept that a certain casualty rate is to be expected?

How can you blame users for opening attachments or expect them not to? People regularly attach stuff to their e-mails that cannot be embedded inline, like spreadsheet reports, images, word processing documents, etc., etc. Given that a worm e-mail is likely to come from a source you know and "trust" like your friends or co-workers asking the recipient to look at the attachment, it is natural to expect that significant number of users will try to open the attachment.

How about asking Microsoft to not let its mail clients execute attachments? Given there are no execute permissions on Windows filesystems, when the mail client is asked to open an executable attachment, it should ask the user to save the file while displaying a visible warning that file being saved is an executable and running it may not be safe.

myDoom[a-z]

[MrBallistic]

do we have to wait for myDoom.z to come out before we start on numbers? i'm still waiting for myDoom 3 to finally get released over here ;)

MS-Doom

[adhisimon]

how about MS-Doom????

Re:None for me

[myg]

Dude, don't give up. Don't use Microsoft e-mail programs either; but you shouldn't shut down your software just because of this crap.

Put your stuff back up. I get tons of spam to the e-mail addresses posted on my corporate website but I'm not about to give up, you shouldn't either. Also, be selective about where you put e-mail addresses on web pages or use special e-mail addresses such as sales@ for that kind of stuff.

Just look at it this way; they can only flood us with penis e-mails for so long before nobody is willing to buy their crap anymore.

Re:Head Explodes MS Security report by Gartner

[myg]

E-mail should not carry files. Simple as that. If e-mail programs made getting an attachment out cumbersome and require a command line; this wouldn't have happened.

People just need to understand that e-mail is not a file transfer mechanism. If they want they can put a URL in the e-mail pointing to their file but then you have some kind of accountability at least (and web browsers should not download executable files without a fuss too).

There is almost no reason why anybody would need to send anybody else executable code. And for the one rare instance where I have had to send an executable to a windows user (a demo of my software) I found it dfficult as it is the user had to be instructed how to save and then execute it.

Why are you contradicting yourself?

[sheapshearer]

Virus-writers don't get to name their viruses, the anti-virus companies do that.

Well you seem to be making one mistake....

The virus writers ARE the anti-virus companies!

The road to wealth....

[sheapshearer]

1) Write a virus with a cool name.
2) Sell it to the anti-virus companies.
3) ?????
4) PROFIT!!!

Re:Parasitic Viruses attacking My-Doom Infected Bo

[rediguana]

The good news is that they're only attacking infected machines (and in a way that's easy to block), but the bad news is that parasites like these can add nasty payloads to viruses that were fast but not particularly nasty themselves.

And this is potentially a big kicker... a fast spreading virus that does little apparent damage may not attract such an immediate response, thereby allowing it to spread further. Following this up with a worm with a nasty payload could have major consequences. Separating the means of infection and the payload could be a very clever evolution to make infections that much harder to manage.

Re:Dumbass alert

[mcbridematt]

What? Geeks who read Slashdot actually have romance in their life?

Thats it! I'm suing OSDN for damages relating to the loss of my social life! I'll see you in court, Rob!

You missed one!

[rock_climbing_guy]

Spammer:
1. Spread a virus opening backdoor in infected systems
2. Send spam trough these backdoors
3. ....
4. Profit!

Geek:
1. Spread a virus opening backdoor in infected systems
2. Install seti@home clients trough these backdoors
3...
4. Fun!

Slashdot Troll:
1. Spread a virus opening backdoor in infected systems.
2. Change users home page in IE to www.tubgirl.com
3....
4. Fun!

-or-

1. Spread a virus opening backdoor in infected systems.
2. Make infected systems slam /. to get in a first post.
3....
4. Fame!

I love you refernce

[rock_climbing_guy]

User Friendly I love you.

alternative to 8080 and 80

[Anonymous Coward]

used for HTTP connections. fuck me and u'all call urself tech guys?

dshield and the number of infected systems

[csk_1975]

I questioned the 50,000 to 75,000 number as it seemed totally bogus and unrelated to the number of source IPs I'm seeing scanning my two class Cs. How can I see 10-15 different source IPs every 5-10 minutes if only 50,000 computers are infected worldwide?

ISC and dshield are showing the number of sources scanning port 3127 building up at an alarming rate. The number of sources seems to be increasing by about 2000 every 10 minutes, which is much more in line with the number of sources I'm seeing scanning my backwater.

Re:dshield and the number of infected systems

[Ben Hutchings]

Maybe some of them are dial-up users who keep redialling and getting new addresses because "my connection's slow!".

MyDoom.zz maybe?

[Mistshadow2k4]

So when might they come out with a MyDoom that targets spammers' websites?

Not that I'm trying to give anyone ideas for something like that. Mercy, no! Shame on you for even thinking that!

Re:MyDoom.zz maybe?

[Anonymous Coward]

And then spammers will simply change their dnses point to anti-spam pages..

Hmmm

[zonix]

Hey, I have a great idea. Why not use this open port on the infected MyDoom boxes to propogate a virus which is set to automatically remove MyDoom and then remove itself several days after infection? It would be a great way to "patch" all these compromised boxes.

Perhaps, but depending on how you execute this, you'd be walking a fine line between being a good samaritan and being the script kiddie who is causing even more network congestion as your "good" virus propagates.

Anyway, this would still be focusing on the symptoms of the virus instead of the cause.

z

Batten down the hatches

[Ashtead]

MyDoom.c and MyQuake.c ...

sounds like these could apply to unix-family systems also, what with plausible commands such as:

cc -o MyDoom MyDoom.c

cc -o MyQuake MyQuake.c

Time to rein in the compilers? Somebody's gotta work hard to make the FORTRAN variant MyDoom.f

Where do viruses come from?

[cpghost]

Ever noticed that vir.us is owned by a certain McBride? Coincidence?

backscatter

[Tom]

Anyone got a good SpamAssassin or procmail rule to filter out the backscatter?

I couldn't care less if it weren't for the flood of "you sent us an infected mail" spam that has been flooding my inbox for days because some stupid morons don't know that auto-notifications on virus scanners should be smashes, crucified, cooked in hot oil and quartered before being shot through the head with a shotgun because all the recent viruses fake the damn sender address.

Re:backscatter

[hacker]

:0 B
* ^*Content-Disposition: attachment;
* filename=".*\.(pif|scr|bat|cmd|com)"
/var/spool/m ail/SPAM

:0 B
* ^UEsDBAoAAAAAA...OzDKJx\+eAFgAAABYAA
/var/spool/m ail/virus

Re:Head Explodes MS Security report by Gartner

[Cynikal]

but its TRUE, Microsoft has conducted some new promisising studies that show their software's security vulnerabilities seem to be iversely proportionate to the number of security analysts they employ. In a bold move, they plan to cut that department's workforce by 2/3 hoping that the trend continues.

hi flamingweasel, this is one of those analogies i spoke of earlier :)

Re:It's an open source virus! (Screenshot of src)

[dekashizl]

For the lazy/short-attention-span/ADDHD, here's a quick link to:
Screen shot of MyDoom.A source code (160 KB GIF).

MOD THIS PIECE OF SHIT AS OVERRATED

[Anonymous Coward]

Fucking unfunny crap. God you saps are easy.

source code

[tuggy]

so now that we have the source code, as soon that the author is caught will SCO sue it for using some of their IP?

MAPS-DUL

[tr0llb4rt0]

http://mail-abuse.org/dul/

The Dial-up user list.

Mail sent directly from a dial-up ip can be canned at the mail gateway.

Not free tho.

Used in conjuction with a decent email virus scanner for legitimate mail should give pretty good protection against email born viruses.

From a business point of view I use www.messagelabs.com for virus and spam filtering.
In the 3 years we've used them no email bourne virus has passed their scanners and reached our systems.

Anti-virus software?

[Anonymous Coward]

What's anti-virus software? I can't find that anywhere on my Mac.

Oh, wait, I just answered my own question.

Re:Anti-virus software?

[Dave2 Wickham]

Here you are, HTH.

Re:Wow, a virus that updates itself over the netwo

[CGP314]

I'll take two!

my ISP is getting smart....

[bakreule]

I haven't received a single inquiry into that port on my boxen.

At first I was wondering why my Portsentry wasn't going crazy throwing IPs into my firewall as "-j DROP", but then it occured to me that my ISP (NOOS France) was probably blocking the port way upstream.

Are most other ISPs finally taking the matter into their own hands?

SHHH!

[fred87]

someone at eweek might see you!

Time for socialized virus medicine

[Zhe Mappel]

Actually, we have the antivirus companies mostly to blame for this one; they discovered it wasn't enough to sell people the software(and that coming up with new features to get upgrades was difficult), but they had to lock them into updates too; pure corporate greed.

Nice work if you can get it, eh? Well, it's damaging to society to reward the inefficiency and arrogance of the antivirus companies when the national interest is at stake.

What to do? Regulate. Regulate Microsoft, and regulate the AV companies. If Ballmer protests, throw him in Guantanamo Bay. (But if he agrees to place nice and do the monkey boy dance in a TV spot advocating the new regulation, let him out.)

As the fields of energy and accounting have amply demonstrated in recent years, you really don't want to leave anything that's critical to the national infrastructure up to the whims of bean counters. Their self-interest will always lead them to sacrifice the common good, and today the safe network is the very essence of the common good. People are imperfect, true; but our problems are exacerbated because the profit motive has been put ahead of common sense.

work-around ...

[Anonymous Coward]

i installed Kerio personal firewall
on all my compis.

then i did a portscan on to all
the maschines ("cbps.exe" from www.bluebitter.de)

the firewall will pop-up and alert that
there's a incoming cnnection.
i told the firewall to create a rule and
block the port(s) (incoming and outgoing)
permanentally.

also don't not surf as ROOT/ADMIN.
if you catch the worm as a normal user
your account won't have enough privileges
to write to "%SYSTEMROOT"

i'm not infected. works for me.

all this worm business really shows
how many people have NO CLUE about
computers. i just hope marketing isn't going
to base their next product on the likes
of these people, or we'll have a one button
computer in a few years time (but then again
prolly the guy infected is a guy working
in marketing *yawn*)

Why does it need to be a worm?

[gotw]

For this Mydoom worm at least, why not have the ISP have a box that listens for traffic likely to be caused by a worm and then install a counter non worm. That is a program that exploits the hole, fixes it, then deletes itself. It'd more than pay for itself in bandwidth and hassle saved. A similar sort of thing could be built into mailservers, where virus laden e-mails as well as being blocked could be responded to with a patch. Of course there is an issue of trust, maybe, although slightly dangerously, there could be some cryptographic mechanism built into e-mail clients to allow code to just be run automatically. I understand there are abuse issues with this, not just cracking of the key, but abuse by those who have access to it. In a situation where you have a huge body of mostly ignorant users who seem unwilling or too scared to learn then it seems you're not given a lot of choice.

There is an alternative to this of course, educate the users. When the internet and broadband start coming into play, ignorant users start to cause serious problems for everyone else. And when the majority of users are ignorant as they are now. Well we see what happens. How about a mandatory broadband driving test. It took a while for people to realise that untrained drivers shouldn't hurtle about the streets and as networks become vital economic infrastructure allowing untrained users to hurtle about them is just as dangerous. The test need not be hard, maybe there could be small tests to lift bars. A level of understanding to be given access to SMTP/IMAP, another level of understanding to have your inbound ports unfirewalled (what percentage of users would notice if you firewalled all their inbound ports anyway? Those that do should be able to pass the test anyway) etc. etc. That's the true solution to this problem. Start teaching kids the important things in school now, I remember IT classes being pathetic. The most important skill is to learn how to keep learning, and not to fear technology.

Mirror sites for sync-src-1.00.tbz?

[Anonymous Coward]

Is there anyone that has posted a copy of sync-src-1.00.tbz?

Einstein?

[r4mrunn3r]

Am i the only one that finds the einstein icon not the appropriate to this subject?

I'm not trying to say this is a good thing but

[Illserve]

One can imagine a future in which such "vigilante" retribution towards companies that are generally perceived to be behaving badly is a significant factor in determining corporate policy.

i.e. Well, if we do , the courts will let us, but the virus community will hit us hard on release day, with consequent profit losses from failed registrations.

Re:I'm not trying to say this is a good thing but

[Illserve]

There should have been a "insert bad thing" in that last line, but I stupidly created an html tag by using >

MyDukeNukemForever

[dark-br]

That's nothing comparing to the upcoming MyDukeNukemForever. You will see!

Only 3127?

[Roofus]

I'm also seeing a large rise in connection attempts on 3128 as well - at least as many (if not more) than 3127. Anybody else seeing this?

Re:Only 3127?

[Durzel]

I've been seeing this also. I've recorded connection attempts on this "unknown" port at almost the same frequency as TCP port 1080 connections.

Started Feb. 1 here

[Anonymous Coward]

Logs say it started two weekends ago but really took off on the 9th. Among the first sites that hit me:

91.172.192.140.in-addr.arpa domain name pointer st02_091.dorm.depaul.edu.
218.24.242.63.in-addr.a rpa domain name pointer den-29-a-218.den.dsl.cerfnet.com.
63.136.205.217. in-addr.arpa domain name pointer raq121.servercity.co.uk.
46.196.74.66.in-addr.arp a domain name pointer 66-74-196-46.san.rr.com.
213.200.51.24.in-addr.ar pa domain name pointer fl-wbu1-c5-200-213.pbc.adelphia.net.
217.42.145.5 2 not found: 3(NXDOMAIN)
50.21.68.67.in-addr.arpa domain name pointer Toronto-HSE-ppp3729241.sympatico.ca.

My Doom...

[Nimloth]

My Doom was the day I installed Windows.
Blessed be thy name, M. Gates!

Re:When will someone use this to their advantage?

[Anonymous Coward]

Is that so?

virus
n 1: (virology) ultramicroscopic infectious agent that replicates
itself only within cells of living hosts; many are
pathogenic; a piece of nucleic acid (DNA or RNA) wrapped
in a thin coat of protein
2: a harmful or corrupting agency; "bigotry is a virus that
must not be allowed to spread"; "the virus of jealousy is
latent in everyone"
3: a software program capable of reproducing itself and usually
capable of causing great harm to files or other programs
on the same computer; "a true virus cannot spread to
another computer without human assistance" [syn: computer
virus]

I don't see your "definition" in there. Just to let you know, you're talking out of the wrong hole.

Principle of least privilege

[Beryllium Sphere(tm)]

>don't you think it is time we took steps to sandbox the email applications?

Why hasn't it been done already? An email client program doesn't need to install arbitrary software on the system and turn off antivirus software, so it's elementary security design that it shouldn't have the power.

Limits of education

[Beryllium Sphere(tm)]

>we need an education campaign.

Don't get me wrong, the long-term solution has to include people getting more "street smart" about their email.

But the industrial safety engineers have been dealing with questions like this for decades and have something to teach us. If you really want to prevent accidents, you won't get very far telling the workers "be more careful" or "follow the rule book". You have to remove or reduce hazards if possible, and always give the workers accurate information about what's happening. If the valves are unlabeled and arranged in some random order, eventually someone *will* turn the wrong one.

Right now we have a huge and unnecessary hazard, namely email client programs that can execute general-purpose computer programs from untrusted sources. We also have a problem analogous to unlabeled valves. Email client programs have been training people every day to double-click attachments.

Re:Parasitic Viruses attacking My-Doom Infected Bo

[Anonymous Coward]

Idiot users AND idiot OS builders who allow idiot users to install mail servers without a password. Serves'em right.

O shit, i thought it was the source code ..

[GNUALMAFUERTE]

Who has named it as mydoom.c?, Symantec?
The one who did was obviously a vb coder, you can't name anything .c, besides as .c

No, not really

[Anonymous Coward]

You imply that consumers have actively chosen a particular virus protection, but in reality, every PC vendor supplies an Anti-virus that has a subscription that lasts anywhere from 30-60 days.

Some people may choose to upgrade the definition at the end of that time, but more likely they ignore it.

So its really a cost-cutting measure from Dell, HP, et al at not supplying a 1-2 year subscription, and the virus companies are guilty for overpricing their subscriptions.

Frankly, I rarely use anti-virus, but I manage not to click stuff sent to me via email. I used to just get warez'd verions of Norton, but with AVG being free for personal use, I don't bother.

Oh, one last thing; running anti-virus constantly slows down your PC significantly; I suggest to people their never turn off their PC and schedule a full scan every night at about 2AM.

They missed a few things -

[mcocke]

When I submitted the same story last night (and was rejected, by the way - has anyone noticed that the slashdot moderators are getting even MORE capricious and arbitrary?) , there was a mention that part of the payload includes the source code (Visual Basic, apparently) to the worm. This should be fun - all sorts of people who wouldn't know how to write a worm now have the source for 'the fastest spreading worm ever'. I predict that ISP level virus monitoring and blocking is less than a year away.

Port3127 is actually this.......

[ElephanTS]

ctx-bridge 3127/tcp CTX Bridge Port
ctx-bridge 3127/udp CTX Bridge Port

Alexander Dubrovsky (dubrovsky_alex@emc.com)

This is the listing for p3127 - wouldn't it be funny if alex dubrovsky was involved ;-)

What was CTX bridge anyway? I can't remember or don't know........

Re:When will someone use this to their advantage?

[protoshoggoth]

If the virus writer can send it patches, then surely we can too

No, "we" can't. The backdoor that doomjuice installs will only accept signed executables.

FEAR, UNCERTAINTITY, DOUBT

[Anonymous Coward]

Oh no the latest virus is going to get me! I haven't received enough of my daily dose of FUD. Does anyone know where I can find CNN's homepage?

Was DoomJuice written by......

[Prince Vegeta SSJ4]

Michael Jackson? in order to implicate a mysterious clan of coders as the real perpetrators?

Re: GPLed?

[Anonymous Coward]

It gives your the source code, eh? Maybe they just want to be sued by SCO for releasing "proprietary" code as GPL.

For those who are overly inquisive...

[francium de neobie]

The source code .tbz is available in eMule now. Just search for the file
"sync-src-1.00.tbz"

If you feel cocky, you can try to intercept a virus payload by listening on port 3127. You don't need to send any initiating message to the zombie connecting to you, just recv() everything is sends you. The payload should be in .exe format.

You realize, of course....

[KC7GR]

...That the image of Einstein on the Slashdot header for this article isn't really an image of Einstein. Noooo, not at all. It's actually a composite representation of what SysAdmins worldwide look like after they get through battling Yet Another Worm, applying the Redmond Empire's Patch(es)-of-the-Month, reminding Clueless (L)users not to click on the pretty executable that came in their E-mail... well, you get the idea...

Is it just me?

[UpnAtom]

My girlfriend's been complaining that she can't get onto MSN all night, and sure enough messenger.msn.com is completely unresponsive, as was Hotmail a few hours ago (though, it seems to be up now). I wish I could just convince her to use Jabber.

Yes. That's exactly what I'd be trying to convince her to do for me.

new linux worm makes rounds too

[BigGerman]

"Hello,
due to inherent security of your box, this worm operates on the honor system:
Please forward this email to all your friends and then delete all your files.
Thank you."

The REAL ORIGINS of MyDoom

[mrex]

Isn't it obvious why MyDoom.C was released? The intricacy makes it fairly apparent that its either the original author or someone connected with it. Why would they release another variant of their own tool?

After the release of MyDoom.A, there was more than a little speculation that the true hidden purpose of these e-mail worms was to spawn a network of zombied PCs to use for spamming. The 'A' version made it a little too obvious, even with the included red herrings of DoS attacks against SCO and MS. Uh oh. And now Mr. Spammer is getting a little antsy -- has the FBI made the same connection many in the infosec scene have? Uh oh. Time to cover your tracks.

What better way to do that than to release another version of your virus that throws all the investigations off the trail, looking for some OSS Loving Blackhat who'd want to DoS SCO instead of the criminal head of a spam gang trying to enlarge his empire?

And before anyone suggests I put on a tin foil hat...go gather some statistics. Specifically, make a chart of the release of e-mail worms, and another chart of the accuracy-rate of DNSBLs. You'll see, as I did, that as DNSBL accuracy reaches 100% (they contain all currently-zombied hosts), boom, out comes another e-mail worm. The release of MyDoom seems to have gone off poorly -- admins received warning and were prepared, not very many machines (relatively) were infected, and a lot of attention from the infosec community was directed at the source of the releases. I'm sure purely by coincidence, my DNSBL hit rate remains high, and spams by a certain well known individual who I believe to be responsible for this don't seem to be coming at nearly the volume one would expect from such a prolific scumbag.

Windows has left open ports for years...

[dtjohnson]

...and it is amazing that even more exploits have not used them.

Naw - here are the real secret masters of the US.

[Ungrounded Lightning]

Wake up call, American Corperations ALREADY decide the president! Big Oil and the Entertainment industry just take turns picking the prez and the rest of congress. ;-)

Close, but no cigar. Hold onto your tinfoil hat!

The real masters of the US are organized crime. Has been so since at least the Nixon-Kennedy election, where both candidates had major mob ties. (And the winner put his brother in as Attorney General, who immediately started a "war on organized crime", using family info to turn the justice department into an enforcer for HIS family attacking its rivals. Possibly the reason both of them were hit.)

Most blatant in recent times was Clinton. I mean come ON! A former governor of Arkansas? Where the whole STATE is run by the branch of the mob that cooled off there from NY whenever things got too hot in the Apple? You don't GET to be governor there unless you're a high boss. Drug running in Mena just for starters. Selling jail-derived blood products to Canada (profiting while spreading AIDS). Turning state police into mistress recruiters. An AMAZING series of inconvenient people dying in airplane crashes. And look at the level of disrespect for all aspects of law-n-order (and suspicious deaths) at all levels of the administration once they went national.

The main effect of the Drug War is to provide price supports and upstart suppression to the large, organized, drug cartels. Gun control (starting with the Sullivan Act) provides victim disarmament, while leaving the crooks armed. Especially convenient for the drug gangs, who don't lose as many of their customers while they're out collecting the cost of the next doses.

Of course that doesn't mean we're that far apart. The entertainment industry, like the casino gambling industry (which they now run, by the way) both arose out of organized crime. The RIAA connection grew from the jukebox protection rackets, and first showed in broadcast during the payola scandals. Meanwhile, lots of mob organizations have laundered their gains and hopped into legitimate business endeavors (often corrupting them in the process. Old habits die hard, and criminal behavior can give a company a competitive edge.)

Thus the RICO act - a dismal failure - attempting to go after the ill-gotten gains laundered into non-criminal enterprise. But RICO was also turned. Now it provides a corrupting influence on the police - giving them a financial incentive to ignore crime and turn to oppression-for-profit, and giving gang-corrupted police departments a weapon to use against rival gangs.

(See? My hat provides better shielding than yours. B-) )

Just stop them

[nroose]

Perhaps I am missing something, but it seems to me that ISPs could stop this stuff. For the MyDoom worm, as well as others, if the major ISPs blocked windows executable attachments, they would never get any traction. This new virus is just a piggy back on the original one, so it would never have happened either.

- Nick

Source code!

[Anonymous Coward]

Offtopic?! Hah! Put the source code on a website, please!

Bah uninformed news things

[mort_au]

... This is the SECOND time I have seen an Australian news source report that SCO 'owns the UNIX operating system'... I first saw it on the age website.... Ridiculous! Don't the technology journalists know anything about what's going on with SCO at the moment? If they had said 'SCO, which owns their own unix-like proprietry operating system' it would have been fine.

RimShot!

[leonbrooks]

Or at least cheap shot... (-:

is it a virus at all?

[mr. spike 2]

Wake me when there will be some new Linux or DOS virus. The real one. Weighting about 700-1k bytes and with polymorphic and stealth abilities at least.

Funny is that todays antivirus programs are extremely similar to simple string-search programs, if not the same. Old ones, like drweb or avpro were able to analyze code and rate it to be safe of not. so it was also able to find ANY morphing or self-hiding codes, so didn't need updates to function well on new real viruses too. Update just gave it ability to correctly name it, or tell for sure about infection.

I am waiting for the cheerful moment when such a good piece of code will spred around for win3.11 new guis like winXP, NT or any of so called "win32".

Just a tip for new viruswriters - windows has a great thing that anything what it will decide as an "update" will be allowed to replace system files, and later anything else will not be allowed to change these files. So virus can get a good protection against ANY anivirus software. Only formatting will help for sure. However if we combine it with BIOS update (at first reboot after infection) and stealth thingys, like it detects when antivirus program or something is aggresively scanning memory and hiding in other parts of it (for example in data arrays of antivirus program itself). memory segment protection will not take place if virus has gained trusty access to flat memory like antivirus progs or windows sys trash have.

Oh my, a "foe"

[flamingweasel]

Hooray!