Slashdot Mirror
New Windows Worm on the Loose
Dynamoo writes "The Internet Storm Center has issued a Yellow Alert due to the spread of the Sasser worm exploiting Windows 2000 and XP machines through a documented flaw in the Local Security Authority Subsystem Service (LSASS) as described in Microsoft Bulletin MS04-011. Initial analysis seems to indicate classic Blaster-style worm behaviour. Right now I'm just getting a probe every 10 minutes or so on my firewall, but this is bound to escalate sharply as the pool of infected machines grows. Of course all good Windows-using Slashdotters visit Windows Update regularly and have a firewall, don't you? More information at Computer Associates, F-Secure, Symantec and McAfee."
the luxury of being behind a nat box with all ports off and not having to deal with such nonsense
What is this 'Windows Update' of which you speak?
Liberals call everyone Nazis yet they are the closest thing to it.
A new worm?Oh, there it is.
Trolling is a art,
Atleast for me as the local consumer support guy.
Thanks Microsoft.
A smile crept across my face after reading this story and then noticing a microsoft ad underneath informing the reader that Windows Server cost of ownership is lower than Linux cost of ownership!
The add server must be based on Microsoft's new Irony.NET framework!
Fox New's official death toll caused by this new exploit stands at zero, but that can change any second now. Find out how to save yourself, tonight after the weather...
No need, I receive all the Windows critical updates by email. I don't know how I got subscribed to that mailing list, but it's damn convenient.
I have a Mac, you insensitive clod...
Where the value of X-Mailer: is the true measure of a man...
In light of this, would someone please explain why I would ever want a Mac? None of the really good viruses or worms are ever ported to it, no matter how successful they are!
I'm impressed that they got the headline right!
Hmm... a new windows worm, exploiting a documented flaw? Never!
Whats new?
# cat
Damn, my RAM is full of llamas.
The worm seems to install a ftp server on infected machines. So, wouldn't it be nice to have every box that detects a connection on port 554, reply with an upload of a new wallpaper to the infected windows box with some message like "install a firewall, moron"
I consider it a public service. Maybe you can even deduct the bandwith for the upload from you tax.
I REALLY hate working dial-up tech support.
(ring)
sigh....
after reading this on the /. front page, i runned the windows update, that i don't visit for more than a year...
and after some time, a windows pops up with the text:
"The software you are instaling has not passed the Windows Logo testing to verify its compatibility with Windows XP. bla bla bla"
"This software will *not be instaled*. Contact your system administrator."
Ok, so i contact myself, and wonders what the hell?!?
I just give M$ a lot of information about the operating system that i'm running... they wrote the frign thing, and even so, they don't know what will run in it, or what will pass their own crap compatibility verification!
but well, that's it... i just click "OK" --the only button-- and see the same windows appears 3 times more... and blissfuly keep my ignorance of what's going on with the instalation.
Only consumer whores and other types of idiots choose to toss out the computer instead of just wiping the hard drive and installing something else.
How refreshing. A Slashdot article about a worm exploiting Windows, without the usual childish jibes. Or FUD. Or spelling mistakes. Well done, Dynamoo!
Of course, then came the comments... :-)
... if we replaced the posts of this thread with the messages posted after a previous worm-announcement, would anyone notice ? :)
;-)
Linux_Zealot says : 5 Insightful - I am using Linux now !
M$_wizard : 5 Interesting - Worms always appear after a security notice from Microsoft Knowledge Base ; so, openness is bad !
security_Teacher : 5 Insightful - Of course, no one should run anything as root but cricital administration tasks, and a firewall is essential.
n00b : -1 Troll - Windows Sucks !!!
Well... That's just a little... repetitive
After I changed email address, I couldn't figure out where I'd subscribed to that newsletter, either... I'd really like it back...
This is like a freaking death sentence considering everyone in town thinks that this is there own free computer tech support hot line.
Here is an introduction to virus for non-windows users.
{{.sig}}
" Of course all good Windows-using Slashdotters visit Windows Update regularly and have a firewall, don't you? " roflol windows-update is the virus factory ;)
http://fedora.redhat.com
http://www.gentoo.org
http://www.debian.org
http://www.linux-mandrake.com
http://www.slackware.com
"Ha Ha!"
Nelson, various Simpsons episodes
No electrons were harmed creating this post, though some may have been subjected to electrical and/or magnetic fields.
Your ideas intrigue me. I'd like to subscribe to your newsletter.
You say "killing IE" like it's a bad thing.
Initial analysis seems to indicate classic Blaster-style worm behaviour.
This made me think of a quote from "Broken Arrow", when Giles Prentice (Frank Whaley) is told there is a "broken arrow", he says,
"I don't know what's scarier - losing nuclear weapons or that it happens so often that we have a name for it."
Otherwise it would be called "Microsoft Walls"
New Windows Worm on the Loose
What, it's been a week already?
Using Symantec AV, I LiveUpdate'd signatures, only to find that it decared System32/w32sup.exe as a trojan and quarantined it.
I work doing tech support for desktop computers made by Compaq and HP, both of which are sold at Wal-Mart. A friend of mine said "welcome to Hell" when I came in today. Now I know why :^(
It's better to vote for what you want and not get it than to vote for what you don't want and get it.
- E. Debs
The new worm
The worm typically shuts down the computer then automatically re-boots it, repeating the procedure several times. Hyppoenen said computers behind a firewall should be spared from the attack.
And how is this different than a typical Windows install?
That's interesting.
:P
Apperently your sarcasm detector is set on "low".
(ps. it was a joke)
warning: attempt at humour follows.
...er where did he go?
Windows' House
A worm appears. Windows is surprised.
Enter Worm
Windows (moronically): duh hello? What are you doing in here?
Worm (aloof): Hey windows, how's it goin? Just wonderin' if I could, ya know, come on in for a bit. I know you don't really know me and all, but I just kinda found you here..
Windows: duh you look like an old friend.. what's his name, Bob.. Blast.. something or other. Ok since you're already here, it's not much, but there's a nice breeze that blows through.
Worm: Can I leave some of my stuff here?
Windows: Ok by me, there's a whole bunch of stuff here, people come by all the time picking stuff up, dropping it off. (helpfully) Let me take that for you.
Worm: Nice! Ummm, while I'm here, I have some code, and I just need a bit... err.. executed. Is that ok?
Windows (wary): Well... I don't know you that well.
Worm: C'mon, please? I'm friends with that guy in, uh, the service department, obviously I couldn't get in if he didn't let me in.
Windows (relieved): Oh him! Oh yeah, he's friends with a lot of people. Ok, I'll execute the code... there ya go all done.
Worm: Excellent. Ok, gotta go.
Enter Zone Alarm
Zone Alarm (alarmed): What's all this then? Who's this guy? Where is he trying to go? Why wasn't I alerted?!
Windows: Oh, he's just... a guy.. he came in for a bit.
Zone Alarm: How did he get in??
Windows (frustrated): Through the service entrance, I told you I got a lot of things going through there and don't want you bothering me about it all the time. The last time you blocked off the service entrance noone could get through.
Zone Alarm: Well don't let him out...
Exuent Worm
Zone Alarm:
Windows (ashamed): Out the service entrance.
Zone Alarm: That's it I quit.
Exuent Zone Alarm
THE END