Worm With Rootkit Package Loose On AIM

Mr0624 writes "According to a recent article on C|Net a new worm is swiftly spreading via AIM to many computers. It delivers a brutal root-kit which bypasses security software and takes control of a PC." From the article: "The worm was spotted in an AOL IM chatroom and infected one of the PCs that FaceTime uses for worm bait. The company said it also has seen the pest hit other computers. 'It is still out there, and it is definitely something the user should be leery of ... The rootkit is designed to not be detected, and that is the scary part.'"

Comments

Only Chat room users affected?

[BoldAndBusted]

So, I use GAIM, and I never use the Chat rooms. Should I worry?

Re:Only Chat room users affected?

[jZnat]

And I use Linux, so I'm assuming there's no need to worry. WINE isn't stable enough to support a virus/worm/trojan/etc.

Re:Only Chat room users affected?

[AnamanFan]

Assuming you're on a Windows operating system.

Use of GAIM will only prevent propagation of this worm. There are more levels at play here.

The worm is actually installed from a link you would click on from an infected IM. Nothing fancy here, it's just a simple HTML link. Clicking on this link will call up your web browser. What happens here depends on both the browser, patches, browser settings, and you. In IE, it's likely that the executable will just run it. Or, ask you to download/run said file. The latter true for Firefox or Opera as well as IE.

In any case, if your computer runs this executable, the computer in infected and it's game over. BUT, you won't be spreading the worm to others since you're using GAIM. The spreading of the worm depends on the AIM (or AOL?) client running on the computer.

That is until the worm writers also write for GAIM.

Re:Only Chat room users affected?

[civilizedINTENSITY]

Well but...wouldn't it also matter if you are running GAIM on Windows or Linux? Isn't too likely a Win binary would run under linux.

Re:Only Chat room users affected?

[EnronHaliburton2004]

Come on over to the IRC chatrooms. We're friendly, and we'll help you to activate some "worm-like" programs on your system. You don't want to miss out now, do you?

Re:Only Chat room users affected?

[BrainInAJar]

Especially linux on amd64 without emul ia32 turned on, like my computer... I can't even run a good chunk of *linux* binaries, let alone binary code for an *entirely* different platform (win32)

Re:Only Chat room users affected?

[Bastian227]

In any case, if your computer runs this executable, the computer in infected and it's game over.

As long as the thing isn't granted admin access, I don't think it's much of a threat (based on the article's description of the worm). It may still try to spread, but the clean up would be relatively easy.

Re:Only Chat room users affected?

[Fordiman]

Hmmm... Probably not. However, I would suggest not downloading and running any exe files from unknown sources. Unlike the idiots usin AIM who've been hit with this.

But you know what? I'm not going to be frightened by a worm or virus until someone writes one that works via bittorrent.

IE: The worm is a compact, surreptitious BT/Kademlia client. There are distributions of the nasty part built for Win32, OSX, and Linux, floating on the torrentstream. The nasty part can be any size, and has constantly updated exploit code for numerous pluggable targets (for example, you, as the virus writer, could add a torrented executable for exploiting a new bug in filezilla server, or in Apache, etc.) The virus core would download this and run it on the local machine. It could even be "smart", and detect the target machine's servers before getting and running the exploit. Once the exploit is run at the target machine, it uploads the BT client virus core for the appropriate architecture, and the process starts again.

One could use the usual tools for preventing detection and removal: polymorphic code, torrential code (code that is split on function barriers and resorted in random order on a per-spread basis), multiple copies, Knowing your Permissions (IE: run itself as user X, make user X root/admin, set permissions so that only user X can know the executable and process exist.) Persistent regression (IE: making sure that the executable is in the startup files of the OS) Trojaning, masking (encoding the executable and running itself via a decoder program) ...

Y'all should be happy I don't write virii. I've been fighting with them so long, I think I'd be pretty good at it...

Re:Only Chat room users affected?

[infinite_improbabili]

Should I worry?

There is no need to worry. Dr. Sbaitso has been called in, and will offer free counseling.

Re:Only Chat room users affected?

[Schemat1c]

'Yes, firefox is indeed greater than women. Can women block pops up for you? No. Can Firefox show you naked women? Yes.'

Sure a woman can block pop ups, all she has to do is giggle.

Re:Only Chat room users affected?

[thesnarky1]

Yes.... your friends who don't can still send you the link. If you click it, boom. I've cleaned this off of 5 systems this moonth among my friends, Two GAIM, and 3 AIM. Its a nasty virus, I might add, and I don't think the article does it justice. Yes, it prerys upon P2P, but the worst part is, most users will click that link before thinking, so its free bait. This is social engineering at its worst, and the only way to stop it is to tell your friends and family right now. No, this is not a chain letter, this is a plea for help, I can only reach so many people on my own. For instance, my away message on AIM right now deals with this article, and the virus.
To answer the parent's question, as long as X person out there has this virus, you are affected, because they can send you the link.

Re:Only Chat room users affected?

[Gojira Shipi-Taro]

Do YOU know an average windows user that doesn't regularly run with account with Admin priveledge? I sure don't, because most applications publishers in the windows world make it more than slightly inconvenient to run with other than Admin level privledges.

So yea it's likely to be granted Admin access, and it's likely to be a threat, on the scal of the whole "nasty shit that causes unnecessary network traffic" thing.

Re:Only Chat room users affected?

[earthbound kid]

Back in the days of CRTs, I was always waiting for someone to write a virus that sets your refresh rate so high that your monitor catches fire. That would have been a cool virus. It's probably too late for it now though.

Re:Only Chat room users affected?

[chrisxkelley]

Hahahaha.
If I had any mod points then I would have given you all of them for funny.
This gave me a good laugh.

mod parent up!

Re:Only Chat room users affected?

[glitch0]

They're COM files - the worm has been going around my town for about a week and a half.

It's usually a link with something like "HEY CHECK OUT THIS PICTURE OF ME - LOLZ!! http://shittywebpage.com/funny.com"

Since most people don't know that an COM file is executable they download and run it.

Unlike the idiots usin AIM who've been hit with this.
Yes, since everyone who doesn't know everything about a file extension not really in common use for many years is an idiot. Plus Windows hides extensions by default, which really doesn't help the problem.

Re:Only Chat room users affected?

[Aenema]

Yes. Even though its likely GAIM won't spread it, you'll still to get some spyware.
Incase you haven't seen any instances where someone is infected the messages are usually similar to

Wow! (http://genericwebhosting.com/XxXILikeSpreadingTro jans/cool.com)
or
Check this out! (http://genericblog.com/picture01.exe)

which can only be so obvious, but, then again, the mainstream instant messaging crowds are full of dumbasses.

Re:Only Chat room users affected?

[name773]

i just reinstalled and went 32bit x86. while the extra registers would be nice, it doesn't matter enough to forego all that software. to add to that, my board only supports 2gb ram max anyway. i set -march=athlon-xp -msse2 -mfpmath=sse to use the sse fp computations in place of 387, so i still get some benefit from having an athlon64 besides the good memory latency/bandwidth.

Re:Only Chat room users affected?

[irc.goatse.cx troll]

Not to mention overclock your videocard, and on some mobos even flash your bios.

Re:Only Chat room users affected?

[Kenyon]

Hahaha Dr. Sbaitso! That was the coolest thing for Soundblaster on my old 286. I wrote some BASIC programs that used that voice synthesizer. Good times, thanks for reminding me!

Re:Only Chat room users affected?

[jrockway]

This has always been my dream virus -- one that flashes the BIOS with a short program that decodes raw audio data and plays it to the PC speaker. "Your computer is hosed. Your computer is hosed. Your computer is hosed."

Maybe when clicking on viruses costs people their entire computer* they'll stop using Windows.

* You and I know that you can just replace the BIOS chip, but do Mom and Pop (or Dell)? Doubtful.

Re:Only Chat room users affected?

[TDO48]

Back in the days of CRTs.... and 5.25" MFM and RLL hard drives, there was a virus making the hard disk heads slam against the casing of the drive: you could set the track number of the head to some track number larger than the maximum number of tracks on the hard disk.... and that's it! If you repeat this operation many times, moving the head inside and slamming it on the casing, you've some good chances of causing the disk to die.

Note that I never had this virus in my virus collection... too bad! Now i guess it's too late to enjoy the nice noise it surely makes!!

Re:Only Chat room users affected?

[destuxor]

On one hand, writing a worm to target GAIM would be really easy, as it's open source. Replace GAIM's main executable with a new one containing whatever worm you want directly compiled into the source code would be short work for these guys.

I do not believe GAIM contains any form of failsafe...I suppose I should contribute to the community by writing a checksum of some form or another to check GAIM installations for rootkits (of course, as an open source application, such mechanisms are trivial to work around...this may require some real engineering). What I describe is the possible nightmare anti-OSS persons propose. Anyone remember IMBlaze, a GAIM ripoff?

However, from what I have seen, there are a lot more Trillian users than GAIM users. As an aside, I would probably use Trillian if there were a Linux build, but there's not, and GAIM fullfils my needs. However, Trillian does not account for nearly the audience AOL Instant Messenger has. I am continually surprised at the number of persons who insist upon using AIM rather than the superior clients that are freely available.

For this reason, I do not predict worm writers to stop hacking at AIM in favor of other instant messenging clients. If they do, the community will engineer a means to stop them before they get started.

Re:Only Chat room users affected?

[jacksonj04]

It's probably easier and cheaper to buy a whole new motherboard than just replace the BIOS.

Re:Only Chat room users affected?

[m50d]

Bittorrent isn't necessary or even the best way for that, too centralised. Any good virus will let you link everyone together in a net and certainly running arbitrary executables over this net has been done, there's no reason updates couldn't be done like this. All the pieces are there, but most virus writers don't use even pretty basic techniques. On the whole, they're not that good programmers.

Re:Only Chat room users affected?

[someone1234]

So you have to use Gaim+firefox, preferably on linux :)

Re:Only Chat room users affected?

[Keruo]

That's what CIH virus did back in 99, except it didn't play audio, but it sure hosed your computer by flashing over the bios.
Now, a worm using 0-day exploit and launching the flash event 4 days after initial infection would quite efficiently wipe down large amount of unpatched home and even corporate computers connected to internet.

Re:Only Chat room users affected?

[Eunuchswear]

Yes.

Next question please.

Re:Only Chat room users affected?

[bhtooefr]

I can't find the link, but I remember reading about a virus that set the vertical refresh rate (IIRC) on a Hercules monitor (you know, the ones that predated CGA) so high that the monitor started squealing, and eventually caught fire.

Who said viruses couldn't kill hardware?

Re:Only Chat room users affected?

[blanks]

"Hmmm... Probably not. However, I would suggest not downloading and running any exe files from unknown sources. "

The two people I had spamming a URL to me were referencing a COM file, not an EXE file.

"Unlike the idiots usin AIM who've been hit with this."

You can still be infected with the rootkit, you just would not be infecting other people. The only thing you need to do is click on a URL that an infected friend sends you, and then double click the file to view/run it. For example the file I was sent was pic0100.com.

So its not just any idiot using AIM, but any "idiot" connected to the AIM network via GAIM, Trillian, etc.

Re:Only Chat room users affected?

[zootm]

I sure don't, because most applications publishers in the windows world make it more than slightly inconvenient to run with other than Admin level privledges.

That's not actually true in any huge way any more, although it was when XP first came out, and most users haven't changed the default behaviour which was necessary to get a lot of stuff to work back then. Also there's some "high profile" applications which have been too dumb to change this (which always gets brought up in these discussions, so I might as well mention it although I don't know offhand what they are).

Re:Only Chat room users affected?

[mikiN]

Your remark only concerns GAIM running on Windows with users running with Administrator privileges all the time.

On Unix-like OSes, patching/replacing an executable require root privileges (unless some headless chicken installs it world-writable, that is). Even if GAIM needs to run setuid, it should relinquish privileges as soon as it is done with them.

Re:Only Chat room users affected?

[stm2]

Could you please tell me how do you turn off ia32 emu? It is a BIOS setting or at software level?

Re:Only Chat room users affected?

[Zog The Undeniable]

If we were still using Motorola 6800-series processors, the virus writers would have released some code with the infamous HCF instruction years ago!

Actually, that's why Apple are moving from PPC to x86, but don't tell anyone ;-)

Re:Only Chat room users affected?

[Psycho 909NL]

ever tried running battlefield 2 with normal user rights (i did)

it just dies with a nice error message that you NEED admin rights to play the stupid game
and i'm sure this is not the only one

Re:Only Chat room users affected?

[zootm]

That's the sort of thing I mean. I don't think there's a particular requirement that games are a special case, but yeah, that's a problem (I own Battlefield 2, so I've seen this). We should really be asking why admin rights are required.

Re:Only Chat room users affected?

[StormReaver]

"Sure a woman can block pop ups, all she has to do is giggle."

Isn't that the cause of most popups?

Re:Only Chat room users affected?

[arkanes]

Almost all games (including Blizzards, and I believe they do this on purpose - if you don't have admin rights, you shouldn't be playing games, is the reasoning I think), and many, many, many software installers. The biggest problems are ones that want to read & write from "system" areas (like C:\Program Files\Whatever and the HKEY_SYSTEM registry branch), and there are still many, many, many of these, even though. The culture of single-user windows is still with us today, and the OS lack of support for simple privledge granting still means that many people who know better still run with admin privledges. The people who don't know better run that way because thats the default.

The technical issues to changing this on the MS side are pretty trivial, its the cultural and behaviorial issues that are blocking it.

Re:Only Chat room users affected?

[zootm]

...OS lack of support for simple privledge granting...

The fairly sad thing is that Windows does have a perfectly good system for privileges, it's just not supported or (at least expected to be) used in anything less than a corporate environment.

Games shouldn't be writing to their install folders (that's what Application Settings is for) or the HKEY_SYSTEM registry branch though. This is an example of developers just being stuck in old ways of doing things.

With any luck Vista won't have people as Administrator by default. That will kill this problem, since people just won't be able to do it any more. It probably requires more luck than it really should, though.

Re:Only Chat room users affected?

[Hosiah]

gee, thanks. Just write everybody a recipee, why don't you?

Re:Only Chat room users affected?

[Anonymous Coward]

An unnamed virus is spreading over AIM, click here to find out how to protect yourself!

Re:Only Chat room users affected?

[Anonymous Coward]

Eh, no. The 6800 processor pre-dates the 6502 processor found in the Apple II. In other words, no Apple computer made after 1980 contains this family of chip. The first computer virus appeared in the wild in 1982.

Re:Only Chat room users affected?

[arkanes]

The fairly sad thing is that Windows does have a perfectly good system for privileges, it's just not supported or (at least expected to be) used in anything less than a corporate environment. Sorry, I was referring to the mechanism for running an application as another user. There's nothing as simple as sudo (or gtksudo) in Windows. The Windows "Run As" dialog is hidden from the user and obnoxious to use at the best of times.

Re:Only Chat room users affected?

[Myself]

There was a way to do this on the Commodore PET.

Re:Only Chat room users affected?

[Anonymous Coward]

First, cryptographically sign each piece of the payload. Have the worm verify each piece before running it, so your installed base isn't hijacked by others.

Second, use TCPA hardware if it's available, to truly take control out of the user's hands.

Third, explain all this in a little EULA that pops up when the luser clicks the link. Bury it in the middle where nobody will read it. If you do it right, you might be able to sue people for removing your worm or writing software that does so. :)

Fourth, call it Trusted Computing.

Re:Only Chat room users affected?

[zootm]

I'm sure it was in the right-click menu for a while. Strange. It's a complex operation that has little meaning to the user, though — as evidenced by the fact that most "easy to use" *nix systems hide the actual reason you need to change user (or that you're changing user at all) from the user... Ubuntu and OSX are two good "off the top of my head" examples of this.

Applications being able to flag themselves as "needing admin access" might be a solution (as sudo does) but I suspect it'd be another thing that MS would be chastised for for whatever reason.

Re:Only Chat room users affected?

[lpcustom]

I'm still using a CRT..you insensitive clod!

Re:Only Chat room users affected?

[nehumanuscrede]

Virus writers benefit Anti-Virus companies the most :)

I've always been of the opinion the best way to ensure that anti-virus software sells like wildfile, is to introduce a new virus now and then into the wild :)

" HEY BOB! "
" Ya ? "
" Profits are down ! Release the hounds.exe! "

Same with many other products out there. Recall the DirectTV unloopers / programmers and whatnot ? I could always picture one of the engineers who BUILT the cards to be sitting at home building the unloopers / programmers at the same time. This brings in cash from both sides and ensures a job for eternity while he works to ' counter ' what the evil hackers managed to bypass :)

Hehe just a tin-foil-hat theory :) Pay it no mind. .

Re:Only Chat room users affected?

[John Courtland]

I have a book on EGA/VGA programming, and it tells you basically how to ruin your CRT by writing the hardware registers. This is obviously before multisync and refresh rate protection appeared on monitors, but it was possible and I'm pretty sure a virus was written to take advantage of it.

Re:Only Chat room users affected?

[Zog The Undeniable]

The 6809 still had HCF, and the 6809 begat the 68000. But I was joking, hence the smiley ;-)

Re:Only Chat room users affected?

[hoggoth]

> there was a virus making the hard disk heads slam against the casing of the drive

Even better (worse), on my old Apple II+ I got a virus that slammed the hard disk head against the casing in a carefully timed pattern to play CHRISTMAS MUSIC from the humming and shaking of my hard drive case!

There's nothing weirder than hearing 'Santa Claus is Coming to Town' coming from your computer and realizing it's not coming from the computer, but from your hard drive which is slowly vibrating it's way off the edge of your desk.

Re:Only Chat room users affected?

[Anonymous Coward]

Depends on the timing.

Re:Only Chat room users affected?

[Anonymous Coward]

That was giggle not jiggle!

Re:Only Chat room users affected?

[BrainInAJar]

It's a kernel option. Also, a gentoo use flag (multilib)

Saves a tiny bit of harddrive space, but more to the point, i'm sure of what i'm running

Re:Only Chat room users affected?

[TVmisGuided]

'Sure a woman can block pop ups, all she has to do is giggle.'

Giggling, by itself, won't block popups. Giggling in conjunction with pointing, however...

Re:Only Chat room users affected?

[vertinox]

This is social engineering at its worst, and the only way to stop it is to tell your friends and family right now.

I told my family and friends to buy a Mac and stop calling me at 3 in the morning.

Re:Only Chat room users affected?

[subsolar2]

Hmm well this must explain why I've been suddenly getting buddy messages in GAIM from user names with "garbage" for profile information.

Re:Only Chat room users affected?

[Ryosen]

>>Maybe when clicking on viruses costs people their entire computer* they'll stop using Windows.

Gee. I've been using Windows since Win286 in 1988. I've never had a virus or been infected with spyware. How is that?

Oh, I remember now. I don't click on the $#@%^#! executables that get emailed to me from asshats trying to infect my machine nor do I use IE, install 3D screensavers and smiley sets, or run software from companies/authors without checking them out first.

It's not a matter of running Windows. Common sense is my OS.

Re:Only Chat room users affected?

[jrockway]

How about the multitude of viruses that infect you without you having to click on anything? You must not have had an Internet connection back in the Slammer / CodeRed / etc. days.

Re:Only Chat room users affected?

[Tigwyk]

It seems the windows "Run As..." dialog also doesn't necessarily give you administrator rights half the time. I've used it to run the MS Office 2000 install when adding things to Outlook, etc. I've told it to "Run As..." Administrator with the appropriate password, and the install failed for lack of privileges. Obnoxious to use is an understatement. ;)

Re:Only Chat room users affected?

[dindi]

agree, but changing privileges under unix/linux is "su" or "sudo" in a term, then you install/configure whatever you need to go, then close that term....

I used to admin some windows machines a few years back (i was a unix admin, but had to take care of some win boxes) and quite honestly the only method I remember was to :

Log OUT/Log in as admin/ log out / log-in as user .... I mean when you run your windows box at home and have 20 apps open, the last thing you want to do is to do all that just because MSN popped up a message that your client is outdated and you have to upgrade now, or no chat, no IM ...

Excuse my windows analfabetism, there might be a "su/sudo" like easy way to become admin without quitting everything but I do not know of it .....

Of course at the workspace users should no install stuff, so that is a different story....

I run my XP box as admin all the time, but I mostly use it to run an X client to connect to my other machine as a 3rd head, or test stuff in IE and access some local gadgets .... I am actually scared to use it online and only access sites I know or ones I really have to and do all IM/MAIL/WEB from my linux box

Re:Only Chat room users affected?

[zootm]

For now, right click an executable and choose "Run as..." to run as another user. With any luck user-switching and the like will be easier in MSH (obviously the current support for just about anything on the command line is lacking).

Re:Only Chat room users affected?

[Ryosen]

I've been on the Internet since 1986, the Web since 1994 and, no, I did not have any problems with Slammer et. al. The firewall and lack of promiscuity took care of that quite nicely.

The worms, however, did help to make me quite a bit of money and brought in new clients for my tech services, so I guess I should be thankful for that.

Re:Only Chat room users affected?

[dindi]

"Run as..."

oooh :) yes I remember now :) HAHA i told i was a windows analfabet :) actually i even seem to remember it in NT :)

but hey ... "sudo whatever" is somehow prettier for me ... or "su"

Re:Only Chat room users affected?

[zootm]

Yeah, I like my sudo. Windows lacks a lot of neat command-line stuff like that.

Re:Only Chat room users affected?

[arminw]

....many software installers....

Doesn't that depend on whether the program to be installed needs access to system directories, such as for drivers? Once the program is installed, why could it not keep the files it needs to change/update in a user's directory? Disk space is pretty cheap these days. That's how it works on Mac OSX. I have never seen a game on a Mac that needs admin access AFTER it is installed. Our users don't get to know the admin password and there has never been a problem with them running games or *any* other programs. Windows has a pretty good permissions system that could go a long ways to prevent the entire system to get hosed by malwares. Creating a new user account is a lot easier than re-installing the entire OS.

Re:Only Chat room users affected?

[arminw]

...and you have to upgrade now...

So? On OSX, an ordinary user will get a dialog box into which to enter and admin name and password. The program will install if the user is able to give that, else, tough luck, call your administrator. No need to login in or out.

Re:Only Chat room users affected?

[petermgreen]

did any monitors literally catch fire under too high refresh rates and if so how did they ever get the things past safety regulators?!

duh

[Anonymous Coward]

"'The rootkit is designed to not be detected, and that is the scary part.'"

ummm isn't that the definition of a root-kit?

Re:duh

[killa62]

Actually, rootkits go out of their way to be undetected.
(Shamelessly stolen from grc.com)
"What happens is, they essentially modify the way the OS itself works. They're compromising the operating system kernel. You know, in operating system terminology we have the notion of a kernel, which is the OS core. And then you've got applications which run as sort of clients of that operating system. So a program you're running, you know, Corel Draw or Outlook or whatever, that's a client of the operating system. Well, so are the spyware scanners. So when you're running even a spyware scanner, it's saying to the operating system - in fact, for example, there are two API calls that's "find first file" and "find next file." So if you ever want to, like, do a directory listing, you'll say "find first file *.*," and it gives you the first file. And then you successively call "find next," "find next," "find next," until it returns no more files. That's all there is to it. So that's - so anything that's scanning your system is basically doing that.

Well, imagine if something altered the way the "find first" and "find next" operated, so that it was intercepting the response back to you, out of the operating system, back to any application that was asking, so that if it was about to report one of its own files, it would call - it would say, whoops, and call "find next" again on your behalf, skipping over that file. Suddenly any program running on the operating system will not see any of those stealthed, rootkitted files. They just disappear. "

link
http://www.grc.com/sn/SN-009.htm

Re:duh

[Anonymous Coward]

Actually, rootkits go out of their way to be undetected.

Uh, no shit. That's his point, that the claim that this is a particularly scary secret rootkit is silly.

Re:duh

[Billly Gates]

Try explaining that to grandma? After all her antivirus software said nothing was installed right?

Explaining about api's only makes you look incompentant if your an It professional because your not speaking down to their language to build confidence.

I had a rootkit last month. Nothing could get rid of it but a full fdisk/mbr where I lost everything. It was MBR based and would append itself when running windows which made it nearly impossible to delete.

Watch as spyware makers do this in the future to prevent anyone from deleting their wares.

Re:duh

[SomeGuyFromCA]

> I had a rootkit last month. Nothing could get rid of it but a full fdisk/mbr where I lost everything.

did you think of obtaining a second computer, mounting that disk as a secondary and copying the data off?

Re:duh

[Anonymous Coward]

Why is this actually called a rootkit? I thought it's called a worm, a trojan, whatever. I thought these things are are called root-kits when they are made for unix-like operating systems. Because there's actually root access to gain. Okay it's nitpicking here, why call it a root kit? It's for Windows, so the appropiate name for it would be something like "Admin-kit" or "Admin-access-kit".

Re:duh

[bhtooefr]

Actually, IIRC, rootkits on Windows give LocalSystem (or higher, there's some things that the kernel doesn't let you access even from LocalSystem) access.

LocalSystem is analogous to root on *nix, except you can't actually log in to LocalSystem (but there's ways to get a LocalSystem cmd.exe).

Re:duh

[Kiaser Zohsay]

IIRC, the name "rootkit" came from the fact that you had to get root access to be able to install it. The rootkit itself was used to conceal the fact that the system was compromised, but the compromise had to happen first.

http://www.catb.org/~esr/jargon/html/R/rootkit.htm l

Apparently "rootkit" will be the next malware term to be misused after crossing over to the Windows world.

Re:duh

[Anonymous Coward]

Gave it to my gf. :-(

Re:duh

[abb3w]

did you think of obtaining a second computer, mounting that disk as a secondary and copying the data off?

Additional solutions on this line include
1) buying a second hard drive and an external USB/FW enclosure; installing OS, minimum drivers, and AV software on the second drive; booting to the second drive, and scanning the orginal
2) Creating a Windows Boot CD using Bart PE or similar; booting to the CD drive, and scanning the orginal

Yes, once this sort of rootkit trick becomes common, life on Windows will begin to suck intolerably. Mac users may be even less happy; many of them don't have AV software, since there hasn't been a Mac virus in about three years. Many don't update regularly, either... which worries me, given that there have been a handful of remote arbitrary code exploits for the Mac since moving to OS X. The *nix rootkit is a fairly mature software technology.

Re:duh

[Anonymous Coward]

Now there's a guy desperate for karma.

Re:duh

[arminw]

.....given that there have been a handful of remote arbitrary code exploits for the Mac since moving to OS X......

Don't all of these need to have admin/root access to write themselves into the system? If the standard user doesn't know the admin password then those things shouldn't get in. I never give the admin password if asked out of the blue and nothing can write where it isn't supposed to.

Re:duh

[abb3w]

....given that there have been a handful of remote arbitrary code exploits for the Mac since moving to OS X......

Don't all of these need to have admin/root access to write themselves into the system?

Checking back, not exactly. While no single exploit would allow a remote attacker to execute arbitrary code with root privileges, there were several patches (EG: this one) where one hole would allow a remote attacker to execute arbitrary code, and a second hole would allow escalation to root privileges.

Also to be more exact, these were potential exploits only: major security holes in the OS that were patched. As far as I know, no demonstration of these exploits — code that actually makes use of such weaknesses — have been publicly released. That distinction is not overly reassuring to my concerns from where I sit.

Looks like...

[Elitist_Phoenix]

It looks like the begin of the end. When enought people come to there senses they might start looking for alternative OS's!

Re:Looks like...

[Cheapy]

Are you aware of all the crap 'normal' people will put up with just to get that cool new Buddy Icon? All that adware and spyware just to get that new theme? People don't *care* about how their computer is doing, as long as they have cool stuff. This will most certaintly NOT make people switch computers. On the other hand...if someone makes a virus that wipes Windows clean and does a netinstall of Debian that passes through AIM, that might make people switch OSes. For a few minutes atleast before they get their copy of Windows out.

Re:Looks like...

[Barbarian]

It looks like the begin of the end. When enought people come to there senses they might start looking for alternative OS's!
 
  Oh, you mean alternative OSs like LINUX for which NO rootkits exist?

Re:Looks like...

[SilverspurG]

I feel pretty safe when the best you can do is cite 3 year old material relevant only to 2.4.x kernels. I still use 2.4.31 but I'm betting that the cited LKM rootkit won't run on it anymore.

Re:Looks like...

[DarkIye]

That's funny, I could have sworn there was something called chkrootkit that had its last update 3 days ago, and is shipped with every Linux distro that has ViM (that is, all the ones I know).

Re:Looks like...

[Hosiah]

When enough people come to their senses they might start looking for alternative OS's!

That'll happen about the time stupid assholes quit recklessly dishing out mod points.

Re:Looks like...

[jasonmicron]

Perhaps even UNIX? Solaris? Wait, aren't all of these OS's the source of rootkits in the first place, hence the name, "ROOTkit"?

Who of us actually would click...

[rkitchen]

"Check out these great new pics of us!! LoLz :)"

Re:Who of us actually would click...

[Nuskrad]

Probably very few of *us*, if you're referring to Slashdot readers, who we shall assume have some degree of computer literacy. However, the vast majority of internet users are idiots. Simple fact.

Re:Who of us actually would click...

[karvind]

:(

You cheated, there was no link in your post. I have been clicking on the post for last 10 min, nothing happened.

Re:Who of us actually would click...

[Agret]

But you posted that 4 minutes after his comment....something's up....TO THE POPE MOBILE!!!

Re:Who of us actually would click...

[kakashiryo]

You want to know scary? My mother asked me where the Desktop was.

Re:Who of us actually would click...

[macsox]

i don't know why i'm engaging on this, but i will.

the vast majority of internet users are not idiots -- they are merely undereducated about computers and the internet.

my nice response to your comment is that you should try to appreciate that not everyone has the time, energy or will to learn computers to the extent that you or i have.

my mean response is as follows: i have a theory. kids start out life talking about how they want to be astronauts, or the president, or teddy bruschi.* they see a vast world of limitless possibility and imagine themselves filling up an enormous space within it. as people age, they start to realize that they most likely won't be a michael jordan or a bill gates, and their response is not to be content being a small fish in a big pond -- it's to reduce the size of the pond that is 'important'. so, i, for example, work in politics. it's easy for me to see the political world i inhabit as the most important thing locally, or even in the world, and to feel very self-important as a result. many users on slashdot see the world of tech as the pond. or their own i.t. departments. people reduce the scope of the important world, until they are a big fish. i call this, uncleverly, 'resizing the pond'.

i posit that you are resizing the pond. and, further, that you shouldn't.

</self-righteousness>

* don't know who this is? there are people who would call you an idiot if you didn't.

Re:Who of us actually would click...

[geminidomino]

the vast majority of internet users are not idiots -- they are merely undereducated about computers and the internet.


"Hey, you don't know me, but I just KNOW you'll love what I have in this box. Go ahead, take it home and open it."

Trusting complete strangers isn't a mark of techno-ignorance, it's a mark of idiocy.

Re:Who of us actually would click...

[Scratched]

Sadly, I clicked a link like that, from a person who normally talks like that so it didn't seem too suspicious until firefox asked if I wanted to download something. Of course the security on my computer is too tight for it to have any affect on me. The next time I restarted my computer it tried to access the internet, my firewall stopped that, it try to change my startup registry, M$ spyway scanner stopped that, and then Norton Anti-virus deleted the virus. Even if you do click it, most people reading slashdot probably have software to stop it from doing harm.

Re:Who of us actually would click...

[ffejie]

... astronauts, or the president, or teddy bruschi.*

* don't know who this is? there are people who would call you an idiot if you didn't.

You mean Tedy Bruschi, surely. Excellent points otherwise though.

Re:Who of us actually would click...

[Nuskrad]

Undereducated I can deal with. An idiot is someone who believes "Turn $6 into $60000 in just 10 days" or doesn't question when someone without any provocation links them to a site they've never seen before.

Re:Who of us actually would click...

[llamaluvr]

I got an IM with a url for some virus/ worm/ exploit from my girlfriend, and it really almost convinced me. It simply said:

"YES!!!! (link next to it, just like a pasted url)"

She says "yes!!" just like that, so my gut feeling was that she found something cool online. Fortunately, I thought better of it when I saw that it was a .com file.

Another time I actually did click on one of those, due to the fact that I was really quite groggy (computer was right next to bed, and I just had been woken up). I was like "ugh...clicky" and clicked on it and it downloaded, and then I started waking up, going, "oh, crap". Fortunately, Windows Firewall blocked it when it tried to phone home, or, er, somebody else, so it wasn't that bad, although, if it was a rootkit, that would still have sucked. Fortunately, I had scheduled to reformat a short time later anyway, just for the heck of it. And even more fortunately now, the bed is really far away from the computer.

That'd be an interesting study, I think...what sort of exploits could be gotten away with where the point of entry is a sleep or intoxicated or otherwise hindered user.

Re:Who of us actually would click...

[macsox]

i wish i could mod this up. particularly because i went to check the spelling of the last name in google after posting, and accidentally typed 'tedy' with only one d. imagine my surprise at not getting the 'did you mean...?' question.

Re:Who of us actually would click...

[Anonymous Coward]

Of course the security on my computer is too tight for it to have any affect on me.

Of course...

Re:Who of us actually would click...

[macsox]

first of all, you seem to think that going to best buy is the same as buying things from people in alleys. which i have to say is a bit simplistic.

second, trusting complete strangers is a mark of being able to function in society. when you leave the house, do you need to ensure that everyone driving down the street is a friend or acquaintance? when you go to a restaurant, do you get background checks on the staff? from whom did you buy the aluminum foil to make your hat? mom?

Re:Who of us actually would click...

[Toasty981]

"Hey, you don't know me, but I just KNOW you'll love what I have in this box. Go ahead, take it home and open it."

Trusting complete strangers isn't a mark of techno-ignorance, it's a mark of idiocy.

I think part of the problem--and nothing earth-shattering here--is that people still think of PCs as a regular appliance. I know people who think of websites the same way they would think of turning on a TV show. If a friend tells you to turn on a station, nothing bad could happen to the TV. They tend to think the same of a website.

Now, the question is whether people who get infected learn their lesson...that's what I'd like to see. Anyone know of any studies or such related to that? Do people take security more seriously once it happens? You'd think so, but we all know people who went back to using IE after we install Firefox/Opera/other because the Flash games wouldn't work.

Re:Who of us actually would click...

[Anonymous Coward]

Just get them to use Linux and they won't have a choice to go back to IE... and they'll move on to a site that isn't microsoft dependant.

Re:Who of us actually would click...

[Kadin2048]

Now, the question is whether people who get infected learn their lesson...that's what I'd like to see.

I doubt it. Most really clueless people will never know that their PC has been rooted, they'll just eventually notice that it's slower than crap (because it's saturating their 1Mb/s cable modem line with packets as part of a DDoS attack) and when it finally becomes unbearable, call GeekSquad or take it down to CompUSA to have it reformatted.

Then they'll start using it again, eventually become re-infected, wait until the computer becomes unusably slow or unstable, get it reformatted again.

I know more people than I'd like to admit who go through this cycle, usually about once every six months or so. A lot of people just figure that totally hosing your hard drive and doing an OS reinstall from system CDs or a protected recovery partition is necessary "maintenance," like changing the oil in a car. You use a computer for a while, the workings get all clogged up inside, and need to be cleaned out...so you drain out the dirty data, replace the OS with a fresh copy, and copy in new fresh data from backups.

Re:Who of us actually would click...

[Anonymous Coward]

tried clicking on the link you posted but it didn't seem to work.. please repost it as I'd love to see your new pics...

Re:Who of us actually would click...

[RollingThunder]

Most of them have been told not to run this kind of thing, but they do it anyways. That's idiotic.

If they hadn't been told, they'd just be ignorant, but they have been told.

Re:Who of us actually would click...

[herriojr]

You're not taking into consideration that it's a message from someone on your buddy list, not a perfect stranger.

Re:Who of us actually would click...

[geminidomino]

Where did I even mention best buy or alleys? A better analogy would be the sibling post to yours talking about taking candy from strangers.

second, trusting complete strangers is a mark of being able to function in society.

Trusting complete strangers is a mark of being a mark.

I don't care if everyone driving down the road with me is a friend or an aquaintance, but I sure as hell don't take for granted that they are good drivers, so I drive defensively. Same with restaurants. If I don't like what they serve me, I don't eat it, don't pay for it, and don't go back there. It's really rather simple.

If you want, you can live in Candy Land and beleive that "a stranger is a friend you haven't met yet." I prefer to keep in mind that a stranger is a potential robbery/homicide in a dark alley.

Re:Who of us actually would click...

[jlarocco]

the vast majority of internet users are not idiots -- they are merely undereducated about computers and the internet.

my nice response to your comment is that you should try to appreciate that not everyone has the time, energy or will to learn computers to the extent that you or i have.

Maybe the vast majority of internet users should take the little bit of time to appropriately learn about computers and the internet. I'm not saying everyone who uses a computer should be system admins, but I don't think it's too much to ask that people who are going to use a computer every day have at least a basic understanding of what they're doing.

If someone were to get behind the wheel of a car and start driving, with no drivers license, having never driven before, they'd go to jail. It's the law that people have to have at least a basic knowledge about their car and how to drive. Yet, at the same time, any moron with $400 can bring home a new computer, hop on the interweb, and have their new computer pwned and DDOSing some random website in 2 minutes because they either don't understand or don't care to follow simple advice like "Use a virus checker and firewall". Obviously, computer and internet use shouldn't be regulated as heavily as driving, but if people can't be bothered to take a little time to learn how to use their computers, they deserve everything they get in my opinion.

Re:Who of us actually would click...

[geminidomino]

In this case, sure.

But the rants about idiot lusers and malware predates this one by a good chunk of time. ;)

Re:Who of us actually would click...

[guaigean]

the vast majority of internet users are not idiots

I have to disagree. The majority of people in general are idiots. Why then can't the majority of people using the internet also be idiots?

Re:Who of us actually would click...

[Anonymous Coward]

"Check out these great new pics of us!! LoLz :)"

Umm, you forgot to post a link.

Re:Who of us actually would click...

[aevan]

Alter that second one a little.. since downloading and executing files randomly sent to you is more akin to inviting strangers into your house and letting them do whatever.

It's a normal part of society having locks on your door and such, to control who goes into your home. So yes, when some man comes to my house and tells me he would like come in and change things, i will make sure he is really from the phone company and not some stranger who just wants to screw around with the wiring.

Complete trust and complete paranoia are both equally bad ways to be. The problem is a lot of internet users seem to lose their sensabilities towards precautions.

To counter your last statement: didn't your mommy streetproof you as a kid?

Re:Who of us actually would click...

[Anonymous Coward]

Check out these great new pics of us!! LoLz :)

Re:Who of us actually would click...

[macsox]

she did, but i still got chlamydia.

Re:Who of us actually would click...

[Anonymous Coward]

I prefer to keep in mind that a stranger is a potential robbery/homicide in a dark alley.
 
That must be fun

Re:Who of us actually would click...

[Toasty981]

Good point. If people never know it's there, they won't learn from their mistakes.

Come to think of it, I do know a few people who do just what you said...reinstall their OS when things go wrong. Maybe in the long-long term, people will make an association between certain activities and having to reinstall.

Re:Who of us actually would click...

[dhasenan]

I do that, actually. I mean, last year I had hard drive failure on my only drive. I reinstalled from scratch. And then I screwed up my partition table after that and had to reformat.

Re:Who of us actually would click...

[joranbelar]

Trusting complete strangers isn't a mark of techno-ignorance, it's a mark of idiocy.

What strangers? The links come from people that have you on their buddy list.

Re:Who of us actually would click...

[Anonymous Coward]

It's amazing how many people on Slashdot can't seem to get by withouth 80,000 different security apps.

My laptop runs Windows XP Pro (only because my beloved FreeBSD wont work on it) without any sort of security software. At all.

The only thing protecting it is a FreeBSD gateway which runs natd/ipfw.

There is no spyware scanner, anti-virus, etc.

I have run copies of Windows (Which reminds me, it's "MS" not "M$". What are you? 6?) for the past 5 or so years with no security software at all and _never_ had a problem.

And for the person who is no doubt going to ask "Well how do you know you don't have a virus if you have no virus scanning software?". Simple. If I had a virus it would have to be one that:

- Did not affect the running of my computer negatively.
- Did not create any network traffic.
- Did not attempt to infect files.

So, if I had a virus that met all of those criteria, I don't think I'd have to worry about catching it.

Anyways, all I really had to say was that security software is stupid:
- Spyware/Antivirus: Use some common sense. If someone wants to show you pictures or something and links you to an EXE, DON'T FUCKING RUN IT. Don't open any executable from someone without an explanation, and even with one don't open it. Hell, before running any unknown executable, just think to yourself "Is the promised reward worth a day spent reinstalling my OS and all my apps and reconfiguring everything how I like it?". Don't have any programs, I MEAN ANY, which automatically run any sort of executable. That's just asking for it.

- Firewall: A firewall is a band-aid. Shut off the services you don't need and you don't need one. As someone's sig here says (not an exact quote): "Don't use your firewall to do your job for you. Shut off the services you don't need."

ND

Re:Who of us actually would click...

[WookieinHeat]

If some people think I am an idiot because I don't know who Tedy Bruschi is. Then those people must be just slightly above the mental retardation (not all the surprising if they are football fans) line for believing most people give a rats arse about the NFL.
God what a stupid sport, twenty minutes of one guy barking orders at a bunch of other guys. While engaging in questionable, if not blatantly homosexual, rubbing and touching. Surrounded by hours of guys standing around in a big field, almost as exciting as golf. One thing they both have in common, if the people engaging in spectating these things weren't completely smashed while watching it, they would probably realize how ridiculously boring those "sports" really are, and go home.

Re:Who of us actually would click...

[Anonymous Coward]

"Hey, you don't know me, but I just KNOW you'll love what I have in this box. Go ahead, take it home and open it."

Trusting complete strangers isn't a mark of techno-ignorance, it's a mark of idiocy.

This kind of selfishness has infected internet discussions since the early ninetees. If you have nothing better to say just don't talk.

The 'box to open at home' would be by itself the object of ignorance. Just as you'd buy any condom you'd find if you never had sex before.

Re:Who of us actually would click...

[Deathanatos]

Who of us actually would click... "Check out these great new pics of us!! LoLz :)"

The sad thing is, people do! And not only do they click the link pointing at some odd site, they download a file, and execute it!

There was an AIM trojan similar (but not the same, I believe) that got circulated to me (by a few of my 'friends') this last week. It's text was something like, "check out these kewl pics of me!" Now, if anyone I know said "kewl" that'd instantly throw red flags. (And still, I got that same IM _6_ times that one night.) So, I take a look. The link points at some odd site, with a .php file. Now, none of the people who IM'd me that night were smart enough to set up a websever w/ PHP. The PHP file, I find, hands you a .com file (With the oh so cliché name img552.com). (Which I think was actually a full Win32 app...) At any rate, through some research, it seems you needed run it in a root user account.

And that's just the thing. Many of these AIM virus/trojan/etc. need not just one, but several lapses of logic to work. They still manage to spread, however. When you click a link, download a virus, and then run it in a root account (although half the world runs as root...)... that's three (usually) fairly obvious lapses in your thinking.

This isn't a hole in the computer, it's the user. Users are..., uneducated. Many /.ers know this, people don't understand how the technology they live with works. Until they do, things like this will continue to work, and people who fix computers will continue to make a living, and we'll keep having to listen to journalism repeat the same words: Don't open executables you don't recognize. (Then again, don't these stupid Windows computers hide extentions by default? We keep telling users not to open things that end in .com, .exe, etc., but all they see is cool_pic(.com!))

But this is /., and I'm preaching to the choir.

Re:Who of us actually would click...

[Crouty]

> the vast majority of internet users are not idiots

I disagree. At least with "vast".

But that is nothing internet-specific. Any community without specific idiot filters has its fair share of idiots. I am aware that this sounds extremely arrogant but it's simply my personal experience.

• People who believe in AD.
• People who voted George W. Bush.
• People who steer a 2-ton, 200 hp SUV without knowing jack about traffic rules.
• People who let anybody in on the doorstep.
• People who click on everything clickable on the internet.
• ....

This well exceeds "uneducated".

Re:Who of us actually would click...

[Anonymous Coward]

It's worse. In the common, everyday media (not only the tech journals), people are warned, again and again, of the existence of roving, infectious "box contents", sometimes disguised as something else, and that because of such things, people should not blithely open boxes.

But people still do, in droves.

People generally understand what it means if they receive ordinary paper mail saying "You've won! Just send us this small processing fee, and we'll send you the cheque." It is probably a scam. People would at least question it. People are usually aware that if someone phones you with the same sort of offer, they should be wary, and hang up. Then there's the guy on the street that says he'll show you something amazing and free if you just stick your head through this hole in the wall for a second. The sign says "Look here". Really? Should I check it out? What kind of dimwit would do so without any questions or evidence that no harm would be done? Hardly anyone.

But click on arbitrary links in a message that could be from absolutely anyone, including forged addresses? Why, of course! Trust it implicitly!

I'm sympathetic to the fact that not everyone is familiar with computers. I really am. But most people seem to have caught on to the vagaries of ordinary mail and phone systems, and common street sense. So, what is the problem here? Is it *THAT* much more complicated because the situation is on a computer screen? I'm tempted to say, "yes, for some people", but given the risks that are widely described by the media, friends, vendors, et cetera, you would think people would be at least as skeptical of the computer equivalent of "look here" signs as they would be in other contexts.

There must be something about computers that isn't merely difficult to understand, but that causes people to be uncharacteristically trusting. I have no clue what that magical force is, but I wish it could be harnessed for good rather than evil.

Re:Who of us actually would click...

[Anonymous Coward]

i wish i could be as cool as you mr. techno-illuminati.

Re:Who of us actually would click...

[siliconjunkie]

....zzzwwoooooosh....

....is the sound of hundreds of slashdotters accessing http://en.wikipedia.org/wiki/Tedy_Bruschi. Not that I'm making fun of /.'ers (I had to look it up, too)

Re:Who of us actually would click...

[moltar77]

"Two things are infinite: the universe and human stupidity; and I'm not sure about the the universe."
-Albert Einstein

Re:Who of us actually would click...

[Nutria]

People who believe in AD.

anno Domini?

Active Directory?

Attention Deficit?

Re:Who of us actually would click...

[siliconjunkie]

Your "mean" response was actually pretty "nice". Trying using more words with harsh "k" sounds at the end and references to his mother's hygiene.

Re:Who of us actually would click...

[Anonymous Coward]

That is human nature. People are trusting of those in control. The computer is in control. People will click on whatever little popup or wizzywutsit just so they can see the cool program. All they want is to run some funny anim that their cousin Bob sent to them. The computer is in control. Not the person using the box.

By nature *I* am suspicious of those who try to control me. So the computer is not in control of me. I control it. Every computer I buy I have the same conversation with. 'I can take you apart or you can work for me your choice'. While it is just an object. It makes me feel in control of the computer.

But think about this. 'Hey heres this cool link its funny'. How many times have you clicked on something like that from your BUDDY on your list? You trust them right? If you say you havent your a liar.

Re:Who of us actually would click...

[uttaddmb]

I got the rootkit IM and it said "OHMG! [link to .com file]"

Lazy. The least they could do is make the link text look like a jpg...

Re:Who of us actually would click...

[Anonymous Coward]

Here:
Check out these great new pics of us!! LoLz :)

I guess we can say Linux is a virus :P

Re:Who of us actually would click...

[fafalone]

The vast majority of internet users are idiots, since while the mean intelligence of internet users is likely slightly higher than the general population, such a large majority of people are idiots that I doubt the minority of intelligent people constitute anywhere near a majority of internet users.
Nobody is asking every user to understand the details of how the TCP/IP protocol works, just basic common sense on par with the level of knowledge they have to have to do things like drive a motor vehicle. You surely wouldn't find it acceptable if the person who crashed into you after running a red light didn't have the time, energy, or will to learn that red means stop. And you surely wouldn't find it acceptable if your children didn't have the time, energy, or will to understand that they shouldn't take candy from strangers.
To put it in terms of politics, people are not idiots if they aren't experts on political analysis... however they are idiots if they don't know the three branches of government and generally what each one does, who the president is, etc. That's on par with the intelligence required to know not to click obnoxious links and open any attachment you get.
It's REALLY simple knowledge and common sense, and there's absolutely no reason people should not be reasonably expected to possess it to use a computer and be derided as idiots when they lack it. Being undereducated is NOT an exemption from being an idiot, if anything it's equivalent to being an idiot. And lacking common sense, or turning that part of the brain off when in front of a computer and many people seem to do, is also being an idiot.

Re:Who of us actually would click...

[Crouty]

Sry, a typo. I meant to write ID (intelligent design).

Re:Who of us actually would click...

[VendettaMF]

Actually, the majority _are_ idiots. Not because they're online. Not because they don't know how to use a computer, but rather because the vast majority of people, both online and offline, are idiots.

"Even" here on Slashdot the majority of posts and posters need strong and repeated application of the "-1 : Twit" moderation.

This holds true in all activities, all continents and all walks of life. Most people do not think, will not think and would believe they weren't missing out on anything by not thinking if they ever thought about it.

The people who can and do think are mostly malicious predators.

Re:Who of us actually would click...

[Anonymous Coward]

You forgot to open your tag.

Re:Who of us actually would click...

[danarch]

It's Tedy Bruschi. I don't think many people consider not knowing the members of the NFL being idiotic. Not knowing who the president is, yes, NFL, no. But after all that has been said in the media online and off, those who would still click on such links are probably not the biggest fish in their pond or anyone else's.

Re:Who of us actually would click...

[Anonymous Coward]

Hey, you don't know me, but I just KNOW you'll love what I have in this box. Go ahead, take it home and open it.

Shouldn't it be something like: I just KNOW you want that little something I have for you. Let's go home to you and put it in your box, eventhough you don't know what you might get infected with.

Re:Who of us actually would click...

[Temporal]

That's nothing.

I was trying to troubleshoot my mom's computer problems over AIM. I tried to direct her to take a screenshot of a window, but she couldn't seem to do it. Then she said "hold on" and signed off for awhile. When she returned, she explained what she had done: First, she opened MS Word and typed out all the text from the window manually. That's fine; more work than she needed to do, but it got the job done.

But, then she proceeded to print out the word document, scan it, and then send me the resulting image.

Yeah. Your guess is as good as mine.

The scariest part is that this same woman has assembled computers from parts and installed Windows on them without outside help in the past.

Re:Who of us actually would click...

[Nutria]

Sry, a typo. I meant to write ID (intelligent design).

That's the 1st thing I thought, but A is so far away from I, it didn't appear to be a typo.

Re:Who of us actually would click...

[Crouty]

*shrug*. It just happens from time to time. Don't know why. Brains are weird.

Re:Who of us actually would click...

[Durinthal]

I got something like that from one of my friends. I immediately suspected it was a virus (since this person never typed in that style and didn't talk to me that often to begin with), but feeling fairly secure with my own system, I did go ahead and click on it.

A Firefox window opened, asking me what I wanted to do with this .com file. Before I could decide on saving or running it (in a matter of seconds), my antivirus popped up with a warning saying that it found and deleted a virus that it found in the temp folder (since Firefox likes to predownload things).

That's all people really need; the software itself usually prevents people from doing too many stupid things like that.

Re:Who of us actually would click...

[Anonymous Coward]

Way to prove yourself wrong, idiot.

Re:Who of us actually would click...

[Anonymous Coward]

Who of you are voting on electronic voting machines that are un-verifiable, and store digitized data that can be manipulated (without a trace), and spew forth that data across insecure networks that can also be cracked into? hmmm?

Why is the policy for this occuring from bastards that do not understand this technology?

I would call you an idiot if you voted on these machines, except you have no choice. So now you must educate yourself and file a complaint locally in your local precint at your piece of shit secretary of state office.

And if you do not do this YOU TRULY ARE THE FUCKING IDIOT!!!

Re:Who of us actually would click...

[SirPavlova]

the vast majority of internet users are not idiots

I have to disagree. The majority of people in general are idiots. Why then can't the majority of people using the internet also be idiots?

I don't know if you're joking or not, but I seriously agree. Even though it makes me sound totally up myself. They're even worse if you get them in groups.

Re:Who of us actually would click...

[glesga_kiss]

Maybe in the long-long term, people will make an association between certain activities and having to reinstall.

Based on what most STD clinics say, that's not going to happen...people just don't learn!

Re:Who of us actually would click...

[glesga_kiss]

And for the person who is no doubt going to ask "Well how do you know you don't have a virus if you have no virus scanning software?". Simple. If I had a virus it would have to be one that:

- Did not affect the running of my computer negatively.

- Did not create any network traffic.

- Did not attempt to infect files.

So, if I had a virus that met all of those criteria, I don't think I'd have to worry about catching it.

How did you know that it didn't dial home? You said you had no security and no anti-virus, and that you were running natd/ipfw. Perhaps if you were also running some intrusion detection software on the firewall, or had an application-level firewall, you might actually be able to say "did not create any network traffic"? What were doing to make this assertion? Watching the blinkenlights on the hub?

The perfect virus (nowadays) does the following:

• Infects silently
• Rarely dials home, and when it does it's piggybacked on another, non-suspicious protocol. E.g. "firefox http://mydodgysite?id=yourUniqueId&data=fillInHere
• Does not inpact the day-to-day running of the PC
• Patches the original vunerability to:
  • prevent other viruses stealing away the rooted box
  • prevent other viruses from impacting the operation of the PC (meaning it gets fixed or reinstalled)

Don't have any programs, I MEAN ANY, which automatically run any sort of executable. That's just asking for it.

You truely are an idiot. ALL programs can do this. It's a basic part of how programs work, they make calls to other programs! The question is, can they be made to run malware through either bad design or exploit (e.g. buffer overflow). There is NOTHING you can do against the latter. Even the infalible Firefox is currently on v1.07 because of EXPLOITS in older versions.

The only system I can think of that can stop apps running system commands is Java. You don't seem like the Java type somehow though.

"Don't use your firewall to do your job for you. Shut off the services you don't need."

That's IN ADDITION to a firewall. NEVER rely on software on your PC to sort out what you have open. A virus can easilly (silently) restart a service, and you'd NEVER know. Likewise with "personal firewalls". The firewall should be a different box with different accounts. If you are truely paranoid, never enter it's password on a potentially hacked machine and stick to console access only.

I hope you are running security for anything important...

Re:Who of us actually would click...

[armareum]

"...The majority of people in general are idiots. Why then can't the majority of people using the internet also be idiots?"

I totally agree with you. For my money, I'd reckon an IQ of about 110-120 is where things start to get interesting. And since an IQ of 100 is an average intelligence, that does sorta make most people idiots. Okay, I know you'll get the occasional savant - but they are the exception that proves the rule.

Also, think about how stupid the average person is.. pretty dumb, right? Well, half of the population are even more stupid!

Re:Who of us actually would click...

[Anonymous Coward]

I think part of the problem--and nothing earth-shattering here--is that people still think of PCs as a regular appliance.

They are simply regular appliances for the majority of people. Not everyone needs to be a computer enthusiast.

Re:Who of us actually would click...

[TLSPRWR]

What strangers? The links come from people that have you on their buddy list.

Just because they have me on their list doesn't mean that I know them...

Re:Who of us actually would click...

[Anonymous Coward]

the vast majority of internet users are not idiots -- they are merely undereducated about computers and the internet.

Even the most undereducated computer users know where the "shift" key* is to create capital letters.

* Don't know what this is? 99% of people on the internet would call you an idiot if you didn't. The other 1% are idiots.

Re:Who of us actually would click...

[StillNeedMoreCoffee]

Idiocy is the wrong term. Trusting is a good positive thing. Hell you would problably pet a snake until it bit you. If you don't have trust you don't have a society. Just like in the olden times we would find what we thought was a safe place to live then we learn that the bear comes back to this cave every winter and we find a new cave. It is our nature to test limits. We want and need to find our own safe spaces. I challenge you to go into the rain forest and not find out through trial and error what is safe and what is not. You can't tell if a plant is benign or poisonous by its outward appearance. If you don't have someone to ask you find out be trying. It is the same here for users that don't spend a lot of time researching computers and the current hazards. The link looks just like a link a friend sent last week. Why not trust it. Well you learn. I am sure in your infancy in computers you learned somewhat the same way. Are you an idiot?

What the idiocy may be is that these funny little boxes with blinking lights are so important to us, and that if it broke we feel bad or worse have actually lost something. An interesting thought that the virtual world has become so important for so many people. But if I found the IDIOT who constructed the virus, well that is another story. There truely is an Idiot. Well ok not an idiot, a clever, un-empathetic, pathetic excuse for a human being to be more acturate obviously not an idiot.

Re:Who of us actually would click...

[Billly Gates]

If its from a trusted user on your friendslist I can see why someone would click it. Usually I know better but if I were having a conversation with someone on my buddies list and this link popped up talking about pics I would be tempted to click on it.

From a stranger its a different story.

ITs classic social engineering and I dont think users are stupid if the worm propogates via the buddylist.

Re:Who of us actually would click...

[99BottlesOfBeerInMyF]

"Hey, you don't know me, but I just KNOW you'll love what I have in this box. Go ahead, take it home and open it." Trusting complete strangers isn't a mark of techno-ignorance, it's a mark of idiocy.

In order for you analogy to be correct, users have to know enough about how poorly their computer is designed to know that they are trusting strangers, which they don't.

For example, if a person who knows very little about technology buys a new portable radio/TV and they are watching the TV and see an advertisement that says, "Bob has set up a cool new radio station. Check it out at 101.3 AM on your radio." And that person then tunes in to 101.3 AM and their radio breaks, would you call them an idiot for trusting the TV? Because that is how most people view computers, sort of like a TV, game console, radio, encyclopedia, and telephone all rolled into one. The problem is not that people are idiots, it is that computers behave very stupidly by default, are very complex and buggy, and do a piss-poor job of informing the user, in easy to understand terms, what is going on. People should have a better understanding of computers, but computers should function much more securely as well. Do most users want to run random executables from the internet? No; so they should be warned when they perform an action that would cause that to happen. When running random executables from the internet, do most users want that executable to have complete access to the network, all their files, all their hardware, and the core components of their OS? No; by default executables from the internet should run in a locked-down sandbox. This isn't brain surgery here. Computers should behave more safely by default and I suspect market forces would have moved them in this direction a long time ago, if not for the fact that they have been bypassed by a certain monopoly. Only now are application level ACLs and jails becoming usable on some systems, because on most systems there is little demand. I suspect this to can be attributed to the aforementioned monopoly. In terms of the inevitable car analogy, If their was one car monopoly and they had not bothered to add ignition or door keys to their cars then there is not a lot of demand for door keys on those "fringe" non-monopoly made cars that make up 1% of cars. No one steals them anyway, since so many cars don't even have ignition keys.

If MS ever gets its act together and makes its OS as secure, by default, as the average Linux distro is today, then the demand will crop up for ACLs, jails, etc. as malware authors move to trojans as their main vector. In the meantime, the computing world crawls forward under the shadow of hugely insecure Windows boxes everywhere. To summarize, people aren't idiots, although they are uneducated. Computers behave in very stupid ways that no one in their right mind should consider an appropriate default for a new user. I blame Microsoft.

Re:Who of us actually would click...

[DrYak]

the vast majority of internet users are not idiots -- they are merely undereducated about computers and the internet.

Let's be more precise :
You have two kinds.
1. The computer-undereducated users, that take everything with an almost paranoid doubt.
2. The uncredibly gullible users, that are fast to click to the first Nigerian scam they get in their inbox, or whatever else they get.

For reference, see the I.Love.You e-mail worm.
You have three way to react to this :
- (educated user) That's surely a Virus ! I'm 99% sure !
- (paranoid user) I didn't ask any one to send me that attachment... why did he send it to me ? And whose the guy with this e-mail anyway ? I don't know him ! Im sure it's telemarketeer's latest technique to get my bucks.
- (idiotic gullible user) Naked pics of Ana Kournikova ? Cool, let's click on them !... Oh, wait, travelling salesman is ringing on my door, I must go see what new wonderful junk he has to sell me.
Now, considering how widespread this virus got, you can guess which kind of reaction was the most common.

- You can't blame undereducated users for using flawed software, or using insecure out-of-the-box settings.
(undereducated user are easy victims of exploit hacking. Not their fault)
- You *CAN* blame user for being to much gullible and click on everything first and thinking only after, when *obviously* there's something really wrong. No, you can't get so rich without doing enything, even on internet.
(undereducated is *not* an excuse for stoping to use your brain and for being so gullible that all social hacking work on you).

Internet is full of people that will do PLAIN WRONG things even if the most basic general knowledge would make them at least have doubts.

Re:Who of us actually would click...

[Toasty981]

In their everyday usage, yes, you're correct. However, I'm talking about in terms of maintenance.

Re:Who of us actually would click...

[WookieinHeat]

Very intelligent reply... "OMG like you put the commas in the wrong places, like you're such a noob OMG!"

How do, you, like these commas, Mr.A,C?

*yawn*

[patio11]

Summary of TFA: "You might have seen this trick before. A friend points you to a link to an .exe file. You click on it and, ignoring the security message which pops up, attempt to run it. Bad stuff happens. BUT WAIT! Now bad stuff includes a 'root kit', too! Doesn't that sound scary and hacker-y?"

Designed not to be detected - as compared to...?

[Telcontar]

"The rootkit is designed to not be detected, and that is the scary part."

You can often judge the quality of the articles linked to by /. by their summaries. Check the definition of root kit before writing such a summary. One would hope that at least story submitters are more competent than the average journalist - but then again, this is /. :-)

Um...

[Anonymous Coward]

The rootkit is designed to not be detected

So ... most rootkits are designed to be detected?

Noteworthy tools

[nmb3000]

I suppose that anyone in the computer tech/repair shop industry might appreciate tools like Rootkit Revealer right now.

Hopefully Microsoft's project that hasn't been released yet will show up soon. They also have a few hints to detect rootkits installed on a system including two Slashdot links.

Hooray for AOL.

Re:Noteworthy tools

[chris_eineke]

I suppose that anyone in the computer tech/repair shop industry might appreciate tools like Rootkit Revealer right now.

I 'spose that anyone in the computer tech/repair shop industry appreciates worms like these.

Re:Noteworthy tools

[nmb3000]

I 'spose that anyone in the computer tech/repair shop industry appreciates worms like these.

Surely, but (from experience) they also like easy ways to fix it. Especially if it can amount to popping an autorun CD in and just letting a script run.

Old..

[Chickenofbristol55]

This is actually pretty old news, one of my friends got this a few weeks ago (he's not a geek, and he called me because I build this custom pc for him). It's quite easy to fix though, a good Ol' system restore fixes it, and there are many programs that can search for, and delete rootkit and other trojans (i'm talking about other programs besides antivirus programs, which sometimes have a hard time deleting these buggers). The trojan was called directX.exe, found in windows/system32 folder. My suggestion: don't click on a link from a friend before 1) you know what it is 2) and make sure that it doesn't say that your downloading a video file, when it's obviously a batch or exe file. This virus is not really a big deal, you just have to have half a brain to deal with it.

Re:Old..

[teslatug]

I hope you're being sarcastic:
1. "old news, one of my friends got this a few weeks" - that's not old
2. "It's quite easy to fix though, a good Ol' system restore fixes it" - no easy would be just deleting it. That's at least a couple of hours worth of time and possible data loss.
3. "you just have to have half a brain to deal with it" - or you could use a better product. Being infected and having your computer rooted just for clicking on a link is unacceptable.

Re:Old..

[Chickenofbristol55]

1) It wasn't my computer, and yeah a few weeks is about 5-6 2) System restore is easy (i didn't say it didn't take a long time 3) I think you missed my point, i was discussing this root kit virus from my viewpoint 4) I hope you're being sarcastic actually

Re:Old..

[mr_z_beeblebrox]

My suggestion: don't click on a link from a friend before 1) you know what it is 2) and make sure that it doesn't say that your downloading a video file, when it's obviously a batch or exe file. This virus is not really a big deal, you just have to have half a brain to deal with it.

Is this a duplicated post. I am sure I read this in 1995 ;-}

Re:Old..

[slashname3]

This virus is not really a big deal, you just have to have half a brain to deal with it.

The problem is that most of the users on the Internet would have a hard time putting half a brain together between them.

Intelligence in the Universe is a constant. The population is growing. You do the math if you can. :)

There should be a project created that is designed to catch idiot users. If they are caught clicking on links in unsolicited emails/IM sessions, buying things from spam, or replying to 419 scams those users have their computers confiscated (and donated to schools) and are barred from accessing the Internet for life. Their names would go on a list similar to the DRPL lists and all sites would be required to check users against that list and report them if they are found on the Internet. These people would also be required to where signs so everyone knows they have been banned from the Internet.

Re:Old..

[paulius_g]

This virus is not really a big deal, you just have to have half a brain to deal with it.

And you need a fourth of a brain to write a coherent comment :-)

Re:Old..

[The Cisco Kid]

I interpret #3 to mean 'you just have to have half a brain, and not run Windows'. And while this specific worm may not be old news, the concept that Windows is and has always been (and will always continue to be) a fertile breeding ground for the like is *very* old news. Unfortunately, way too many people have their heads in the sand and refuse to open their eyes.

Re:Old..

[Anonymous Coward]

It's quite easy to fix though, a good Ol' system restore fixes it, and there are many programs that can search for, and delete rootkit and other trojans (i'm talking about other programs besides antivirus programs, which sometimes have a hard time deleting these buggers).

Rule #1 when dealing with rootkits (or other break-ins)... The system can no longer be trusted. That means any and all executables on the system are suspect (including System Restore functionality) and may have been tampered with.

On a unix/linux box, that means shutting the system down and booting from read-only media that cannot be tampered with. Then you use tools that are only on the CD/DVD to investigate the system and find out what files have been changed / corrupted / hijacked. This is where tools like Tripwire come into play (or simply using fingerprinting tools like md5sum and doing a diff between two sets of signature files).

On a Windows box, you're better off with a format and re-install from CDs. Or, if you thought ahead and created a disk image using Knoppix, you could restore using that image. (Be sure that it's an image that you know is clean.)

Luckily for you, it sounds like the worm that you dealt with was apparently not very sophisticated. But how can you be sure that you've removed that rootkit from the system? And who's to say that the next one won't interfere with System Restore?

Never assume that worm writers are stupid. Don't assume you can outsmart them. However, most of the time (unless you are a specific target), worm writers are looking for the biggest return for least effort. So a worm that infects the majority of hosts is enough and they will not bother writing the code to infect the rest.

IOW, if System Restore functionality begins to have a significant impact on infection rates, you should plan on System Restore functionality being broken by future worms.

In summary:

- Backup your data files regularly.
- Boot a Knoppix CD/DVD and fingerprint your system regularly for a baseline to compare against at a future date.
- Use that Knoppix CD/DVD to create snapshot images of your currently working (and uninfected) system.
- If you're infected / invaded, assume that you haven't found everything and will need to rebuild the system from scratch.

(Yes, I've fought off a rootkit once. It was a real pain.)

Re:Old..

[armareum]

...one step away from amateur eugenics.

Woot!

[dcapel]

Another virus to try to run with Wine on my linux box :D

Re:Woot!

[Kadin2048]

Do you think it's worth filing a bug report if the rootkit crashes WINE? Or would that be a feature request?

When everyone runs as root already

[Andrew Tanenbaum]

or "Administrator", rootkit designers don't even need to escalate privelages. I can't wait for Vista :|

Re:When everyone runs as root already

[Mantus]

Due to poor software design, it's difficult to not run ad admin. Most programs run no problem, be some, like WinAMP, need to have their directory permissions changed to run and a non-admin. While this isn't a problem for power users, most users won't even know how to change the permissions (in XP Home you need to boot into safe mode to get the security tab to appear in the file properties windows)

Despite the fact that the \Documents and Settings\username folder exists, some developers choose not to use it, and that causes problems.

Updated my client ... and

[krray]

I just logged on to my AIM [.Mac] account and went looking for this "root-kit" (as I do have the 'root' user enabled on my Mac for various geek reasons :). It did take me a while to find the "lockx.exe" file being offered, but it was quickly downloaded with my 10Mbit pipe. I was even WARNED that I was downloading a executable (?) and did I really want to proceed (of course I did).

I suddenly found myself with a .EXE file on my desktop to which I quickly doubled clicked it to open it.

"There is no default application specified to open the document."; Which one should I choose? :)

Re:Updated my client ... and

[Anonymous Coward]

sounds like a job for Virtual PC running Windows.

Re:Updated my client ... and

[generic-man]

If you have Virtual PC installed (I have VPC6), then .exe files are associated with Virtual PC by default. You have to be VERY patient while Mac OS X boots VPC, VPC boots Windows, and Windows starts your rootkit, but it is possible to infect your virtual machines with just a few mouse clicks.

Fortunately, Mac OS X 10.4 broke the networking config in my virtual Windows instance, so the machine will be pretty safe from outside intrusion even after the rootkit is installed. :)

Re:Updated my client ... and

[rdoger6424]

Is this a troll or a compliment? I could see it from both ways.

Re:Updated my client ... and

[Rick Zeman]

If you have Virtual PC installed (I have VPC6), then .exe files are associated with Virtual PC by default. You have to be VERY patient while Mac OS X boots VPC, VPC boots Windows, and Windows starts your rootkit, but it is possible to infect your virtual machines with just a few mouse clicks.

But not if you've undone Connectix/MS's collective stupidity and associated .exe, .com. bat. .pif, etc, with something like Virex. Purely for amusement's sake, of course. :)

Re:Updated my client ... and

[Anonymous Coward]

rotflmao

"Popular with people with money who don't know how to use a pc" ?

Now _that_ has got to be the funniest (or dumbest) statement I've seen yet.

I'm not even sure where to go with that -- other than to simply state that I
(the original poster :) certainly know how to use a PC. Admin hundreds of
Windows (garbage) boxes and simply know better than to use it in my home
(or even let my parents use it for that matter).

I know enough to migrate networks from Windows to being completely LInux
and/or Mac based -- and even would prefer BSD based servers when appropriate.

In your terms, yeah, I have money (good money to be made as a Sys-Admin :),
and know how to spend it on good equipment and a good OS. If you think Mac's
are over priced -- think again. They're really not when you compare Apples to
Apples (no pun intended).

You, OTOH, may enjoy your Windows box. Sucker.

iChat + OS X

[ian rogers]

I sure hope I don't get pwnd.

Re:iChat + OS X

[Anonymous Coward]

" I sure hope I don't get pwnd."

Looks to me like you already have been ;)

Re:AIM client, or AIM protocol?

[antifoidulus]

Considering the rootkit is spread by users clicking links and has NOTHING at all to do with the protocol, I'd have to go ahead and have to say yeah, it can spread via any client that lets you click on links and I'd also have to say RTFA

Root kits

[Rufus211]

"The rootkit is designed to not be detected, and that is the scary part."

As opposed to those root kits that are designed *to* be detected? Damn it, thinking again instead of being scared into buying something. Really need to work on that...

Re:Root kits

[Anonymous Coward]

-10 redundant

Re:hah

[saskboy]

Frequently Messenger type programs get worms that do NOT require the user to click, thus making the virus that much more worm-like since it doesn't require user intervention. Windows XP had several of these vulnerabilities, and so did MSN Messenger 6. Did you ever wonder why Microsoft forced upgrades sometimes? It's because a critical bug was found in their JPG processing code for instance, and the mere presence of MSN 6 and an infected buddy messaging you automatically, because they got infected automatically, meant you got infected too. It came through a malformed .jpg or .png Avatar picture that on most Messengers is set to download and display upon arrival of any message from that person, even a message sent by a virus.

Why aren't they prosecuted?

[Anonymous Coward]

The worm also places several spyware and adware applications, including 180Solutions, Zango, the Freepod Toolbar, MaxSearch, Media Gateway and SearchMiracle

At least one of these companies (the first one I checked - 180solutions) have a website, business address and contact information. Why in the hell are they not being prosecuted into oblivion? They are obviously benefiting from illegal seizure of people's machines; who else could be responsible for spreading this shit?

Re:Why aren't they prosecuted?

[Jeng]

Honestly that has bugged me the most about not only trojans like this, but spam in general. Why go after the distributer, go after the source. There'll always be another spammer or script kiddie up for takeing the last guys place.

Make it unprofitable for businesses to use these tactics and the tactics will go away, or at least be less prevelent.

Re:Why aren't they prosecuted?

[generic-man]

180solutions is not a perpetrator and you can't implicate them in this scheme. If someone spray-painted "HAHA I RULE, SINCERELY, JOE SMITH 212-555-5555" on your house would you immediately call the cops asking that they arrest Joe Smith? Let's not forget what Joe Jobs are.

Now 180solutions could invoke the terms of their affiliate agreement and freeze payments to the scumbags that install this software on the sly. Of course that's no consolation to the consumer that gets stuck with that adware/spyware on his machine.

Forcibly installing 180solutions' software is no different legally than forcibly installing Firefox the next time someone visits your website with an unpatched version of IE. Both are immoral and should be illegal, but the software authors can't be faulted for producing software that may be installed without the user's consent by way of an IE vulnerability.

Re:Why aren't they prosecuted?

[The Warlock]

The serious rootkit stuff isn't done by the spamhausen for money, it's done by crackers who want to create zombies for DDoS attacks.

Re:Why aren't they prosecuted?

[olddotter]

Expect that installing Linux on an unprotected Windows box would be funny!

Re:Why aren't they prosecuted?

[Jeng]

True, but per the parent and the article this worm does have some financial backing, or at least people with established businesses are being linked to this in a fasion that makes it look like they may be makin some money off this.

Googling the ones listed they all appear to be malware providers. This is what they do for a paycheck, it would be real real real hard for them in the court of law to prove that they did not create this trojan considering their prior history.

Re:Why aren't they prosecuted?

[Animats]

180solutions is not a perpetrator and you can't implicate them in this scheme.

A good prosecutor might be able to bring it off. The legal definition of a punishable conspiracy is generally that at least two people knowingly cooperate to commit a crime, while in addition at least one of them does some illegal act to commit the crime.

180Solutions is already being sued in a class action. From the complaint: "180Solutions pays its distributors, who are its agents, money each time they infect a computer with 180Solutions spyware". Recruitment of agents and payment can be sufficient to establish a conspiracy, especially if there's a history of illegal acts by recruited agents. Read more of that filing to see how the plaintiff describes how 180Solutions not only tolerates, but pays, agents who use illegal means to force the install of 180Solutions software.

Since this lawsuit was filed, 180Solutions claims to be mending its ways. However, they're still allowing their existing affiliates to distribute the old, spyware-stuffed version of their application unti the end of 2005, so they're not too serious about it.

In any case, ceasing criminal activity is not a defense to previous crimes.

Re:Why aren't they prosecuted?

[Anonymous Coward]

If someone spray-painted "HAHA I RULE, SINCERELY, JOE SMITH 212-555-5555" on your house would you immediately call the cops asking that they arrest Joe Smith? Let's not forget what Joe Jobs [everything2.com] are.

I think a more equivalent analogy would be a fence. Are you suggesting that trafficing in stolen property should not be illegal? After all, fences don't commit the thefts involved; they just profit from illegal activity.

Re:Example

[Jeng]

Mind elaborating on the example? I'm sure there are plenty here who could say what exactly that was you linked to, I'm not one of them. I'm just happy I'm smart enough not to run it.

Old News

[xaosflux]

SDBot is certainly not 'breaking news' variants have been out for more then 4 months!(http://vil.nai.com/vil/content/v_134563.ht m)

People choosing to run executables from IM's (while logged in as adminsitrators) get what they deserve.

Re:Old News

[Anonymous Coward]

actually, [sd] released his first test release circa 1999, but only those of us that were there at lcirc would know that.

Re:Old News

[Anonymous Coward]

to bad the first versions of sd suck asshole, Bots would not stay connected for more than a few minutes, the "CONNECTION RESET BY PEER" , yea i know theres mods that fix this, but damn theres so many better bots now.. props to SD though for paving the way

As compared to the one with the alert box?

[Saeed al-Sahaf]

How about a root-kit with a pop-up: "Do you want to install this Root Kit? Yes / No"

I'll bet that there are a lot of people that would just click on through for what ever the carrot is, screen savers, free porn, or whatever...

Re:As compared to the one with the alert box?

[Entropius]

This's work especially well in Australia, when the root-kit *could* be the carrot...

True

[earth_daemon]

Not that it's always true but mostly the reason that corporations are hacked and people contract viruses on their computers is failure to be more cautious ON_THE_PART_OF_THE_USER.

Re:True

[QuantumG]

Well it's not like Run As User.. actually fuckin' works. Why does Microsoft put this shit in their OS if it aint gunna work?

Re:True

[Anonymous Coward]

It works just fine on XP Pro, but "isn't supported" on XP Home Edition

Re:True

[drinkypoo]

It works just fine on XP Pro, but "isn't supported" on XP Home Edition

It doesn't work fine on XP Pro. Installs commonly end up not working as the proper user. My theory is that the 32 bit installer launched by a 16 bit launcher (for installshield) doesn't inherit the proper user context. Haven't had problems running installed programs as another user, though.

Re:True

[QuantumG]

CreateProcess

The CreateProcess function creates a new process and its primary thread. The new process runs the specified executable file in the security context of the calling process.

If the calling process is impersonating another user, the new process uses the token for the calling process, not the impersonation token. To run the new process in the security context of the user represented by the impersonation token, use the CreateProcessAsUser or CreateProcessWithLogonW function.


i.e., the problem is (one again) that Microsoft is braindead. You click RunAs on a program and select the Guest user. The program runs as the Guest user. If that program then spawns a new process using CreateProcess does it run as Guest? No, it runs as YOU.

No biggie

[Anonymous Coward]

Just reimage the machine and the problem goes away. :O

Hopefully you have an updated image to use. If not, you will be hangin out at the Windows update site for 2 hours.

Re:No biggie

[Anonymous Coward]

Ok...btw, you get to be the one to tell a spoiled rich kid that he's going to have to have his computer wiped, and all his downloaded pr0n and gamez and mp3z and all that crap is going to go away because University policy says we don't back that up.

Yea. You have fun with that.

I hate kids.

Wow...

[megabyte405]

Not sure how you have a rootkit on a system (Windows) that doesn't have a "root" user per se... Presumably it's so called because it gets admin privs, but they aren't needed for much on Windows. It's not even that tough to remove, and I've seen it starting a few weeks ago. Much ado about nothing on C|Net is what this looks like - AIM worms aren't anything new, especially not when you work with college students.

Re:Wow...

[Anonymous Coward]

Go read up on the definition of a root kit.

Presumably it's so called because it gets admin privs.

Nope. A root kit is designed to hide itself from detection after being installed on a machine that was compromised by other means such as thru a vulnerability or trojan. For example, it might hook the system functions to enumerate files in the file system so it's files doesn't show up in directory listings, even when you choose to list hidden files. A good root kit must hook many more functions than that so the process doesn't show up in the running process list, so it's disk usage isn't missing from free space, so it's memory and cpu utilization are hidden, etc.

Up until fairly recently (the past several years or so) rootkits were extremely rare on Windows machines. They have been around on unix and other operating systems for decades. Once a good root kit is installed, it can be extremely difficult to remove, or even KNOW it is installed.

AIM worms aren't anything new

Worms that install root kits aren't new, per se, but they are not at all common. There has never been one (so far) that infected more than a trivial number of computers. They are more commonly used by black-hats manually hacking a specific target in order to protect their installed files and processes once they gain access through other means.

Rootkits are much more problematic than other types of malware becase, as I wrote above, once a good one is installed, it can be very difficult to detect from the running system. Virus scanners and such are useless. Sometimes the only way to get rid of them or even detect them is to boot from known clean media and scan from there.

Of course you'd have to have a reason to suspect you've been compromised before you would do that. One major ISP had several dozen machines infected without knowing it until an operating system patch caused the rootkit to start crashing. Naturally they blamed the OS vendor for the crash until the real problem was discovered.

Re:Wow...

[oPless]

Actually it's much worse.

Administrator privs on windows is pretty much "root" as far as users are concerned *but* there is a higher level of privs. The SYSTEM user, which has a complete control (iirc, and I might not cos it's 4:30am here) it's near enough acting like the operating system as makes no difference.

rootkits tend to get themselves to SYSTEM privs :o(

Re:Wow...

[egypt_jimbob]

A rootkit is not something that gets you root. A rootkit is something you install once you get root for the purpose of keeping it. What this usually means is hiding files, hiding processes, creating backdoors and generally doing naughty things quietly.

In Linux, this is usually accomplished by replacing system binaries (ls, ps, ifconfig are standard targets of this) or by modifying the kernel itself. Modifying the kernel takes two forms, overwriting sys_call_table[] or one of its elements and overwriting Virtual Filesystem functions. I'm sure windows rootkits do similar things.

Re:Wow...

[xiphoris]

All that is required for Administrators to gain Localsystem (what you referred to as SYSTEM) privileges is to start a particular executable as a service. At that point, the executable has *complete* access to the machine, as root would on Linux.

It is trivial, for example, to start even a command shell with such privileges. I'd provide a link, but I have to leave shortly :) Check http://www.sysinternals.com/ for examples, I'm sure they have one.

malware social engineering

[G4from128k]

TFA suggests that this worm (technically a trojan) spoofs a buddy -- making the worm-loading link seem innocent. The advice is to always confirm that your buddy sent you something. I leave aside the reality that most people aren't going to pester their friends with a "Did you just send me something" messages. It may be good advice, but most people probably feel like paranoid lusers asking every time a buddy sends a link.

The bigger point is that malware need only become better at social engineering to convince most people not to ask. If the worm sent two messages -- one with the link and a second one with a friendly confirmation ("Hope you liked that link. See you later."). This could easily convince many people that it was a trusted link from a trusted source. By the time they actually talk to the friend (if they do) and mention it, the friend will deny sending anything, the infected person will check their PC, find no evidence of an infection and just be puzzled by the exchange. But it will be too late.

Yes, some people might still ask or be suspicious. But infectious malware needs only to succeed with a very small % to create a very large and valuable botnet.

Re:malware social engineering

[Anonymous Coward]

With email, I subscribe to the practice of always attaching some meaningful personal text. Conversely, anything that doesn't have a commentary gets confirmed (if important) or, more usually, just binned.

This has been surprisingly effective because my friends don't talk like a cheap sticker book. Chat might be a little different depending on timing: the scenario you suggest could be effective and I can think of some that are much more devious:

On send URL...

10 seconds later...
"Oops, wrong link. Try this."

or worse:

Re:malware social engineering

[earthbound kid]

It would be interesting if someone made a Liza virus-bot.

Liza: How do you feel about opening [link]?

Buddy: Uh, ok, whatever.

Buddy: Dammit.

Liza: Are you angry at me because I pwnzed j00?

Re:malware social engineering

[WhatAmIDoingHere]

That's what the virus my friend had did. It said "i look so wasted in this pic!" and gave a link. That's also what the MSN worms did. "Check this link for a cool pic!" I'm surprised it's taken this long for this crap to jump from MSN to AIM.

Well...

[slavemowgli]

It delivers a brutal root-kit [...]

As opposed to the usual kind and gentle root kits, I suppose?

The rootkit is designed to not be detected, and that is the scary part.

Isn't that part of what makes a root kit?

Shiny Red Button

[jpostel]

You should put a big "DON'T CLICK THIS LINK" just to see how many people actually click it.

Don't press the Shiny Red Button!

Re:Shiny Red Button

[Anonymous Coward]

It didn't work

Re:Shiny Red Button

[Anonymous Coward]

http://blender3d.org/cms/typo3temp/pics/0f8f634142 .jpg

Re:Shiny Red Button

[bcat24]

Something like this?

Re:Shiny Red Button

[redheaded_stepchild]

DONT CLICK THIS LINK!!
Please God No!!

I got hit with the lameness filter! How appropriate.

.com file

[poshul]

How many people still use .com files anyway? If anyone sees that isn't it kinda obvious? Also hasnt this been floating around for a while, at the beginning of this month I saw it and submitted it to Symantec, they said it was an old trojan

Re:.com file

[Anonymous Coward]

That's a good thing for a rootkit builder, isn't it?

The average person sees .com and thinks it's a website (or, rather, website link of some sort)...

For instance, if your non-computer-using friend sees a file named, say, www.ebay.com ?

Ad Nauseam

[Secret Rabbit]

"This is the first time that we have seen a rootkit as part of the bundle of applications that is sent to your machine. It is a disturbing trend."

One worm does not a trend make.

"The rootkit is designed to not be detected, and that is the scary part."

Isn't this the actual point of any worm/virus/etc. To not be detected so as to be able to do what it's supposed to do. Haven't these things been doing this even before the 90's... really since the beginning.

This is just more typically stuff. User gets something that looks like it came from someone they know and they click on the link like the dumbass user that they are. This despite the fact that they are *always* told to never just click.

They'll never learn and as such, things like this will continue to happen. Stuff like this became not news to me a *long* time ago.

All I have to say is, ad nauseam.

It's not a worm

[Anonymous Coward]

Mr0624 (article submitter) and Joris Evers (article writer): why call this a worm when it is clearly a trojan horse?

From TFA:

"A very nasty bundle is downloaded to your machine" when you click on the worm link, said Tyler Wells, senior director of engineering at FaceTime.

ugh. I bet you think that all hackers are bad, too.

Re:It's not a worm

[mrchaotica]

No, it's a worm because it's capable of replicating itself. In contrast, a trojan horse doesn't replicate (it has to be manually shared), and a virus only replicates by infecting other files (which have to be manually shared). This worm, on the other hand, is capable of sharing itself via AIM.

Re:It's not a worm

[NieKinNL]

It's not a worm, it's a caterpillar! Just look at the image..)

A couple of hours?

[mindstrm]

System Restore in XP typically takes less than 5 minutes, and extremely rarely causes any data loss.

You have used system restore, right?

Re:A couple of hours?

[teslatug]

Nope, I stay away from Windows.

Re:A couple of hours?

[mindstrm]

Right then, well, "System Restore" is a feature of Windows XP that snapshots the status of a whole bucketload of system settings, DLLS, etc... each time you update software, and at other times determined by the system, these snapshots are taken. You can go into system restore and revert to your system status from yesterday, last week, or just before oyu installed something, and it generally works very well (meaning quickly, reliably, and doesn't erase your data.) It doens't make a mess, either.

It was a very surprisingly well done feature, I can't actually believe it came from MS

Re:A couple of hours?

[teslatug]

So Windows keeps a backup of every file on the system, at any point of time?? That must waste some space. I wonder what would happen if the worm made it past the last restore point, would it restore the worm as well?

Re:A couple of hours?

[evilneko]

It probably didn't. ;)

Re:A couple of hours?

[qbwiz]

I believe it only stores the system files that have changes/the differences in the registry, etc. Most user files are not included.

Because there are multiple restore points, newer points could restore the worm but older points should be free. Unless the worm inserts itself into them, that is.

Re:A couple of hours?

[SomeGuyFromCA]

> I wonder what would happen if the worm made it past the last restore point, would it restore the worm as well?

it does. good thinking. now if only you worked at micros~1 and had pointed that out back when...

Re:A couple of hours?

[advocate_one]

It was a very surprisingly well done feature, I can't actually believe it came from MS

I would expect it got used a lot inhouse... they had plenty of opportunity to get it right without having to get the general public to find the bugs in normal use

Re:A couple of hours?

[Anonymous Coward]

Oh, as far as I'm concerned it shows every sign of having come from MS. I tried it, once, against my better judgment. It thoughtfully reverted hundreds of files in my CVS checkout for me. It took me hours to get back to where I was--at least, where I think I was.

Never again.

Re:A couple of hours?

[GweeDo]

System Restore is already a nightmare when it comes to dealing virii. There are many out there that implant themself into System Restore at which point Norton/McAfee/Whomever isn't allowed to touch them. So...you remove the "active" version, then reboot and the System Restore version pops up and infects you all over again.

Yeah...System Restore is really well designed.

How to remove it. The answer.

[TheGSRGuy]

http://www.jayloden.com/VirusClean.htm

This tool is updated almost daily. 100% effective, I can vouch for it. You can become infected if you click the link on non-AIM clients, but it won't spread to everyone else on your buddylist.

Re:How to remove it. The answer.

[rhizome]

I can vouch for it.

And who are you?

Re:How to remove it. The answer.

[Atragon]

And who are you?

He's TheGSRGuy of course.

Re:How to remove it. The answer.

[Al Dimond]

It also won't spread to everyone on your buddy list if your "buddies" have a grain of intelligence. If you get an IM with a download link for an executable, ask the person what it is before downloading it, or at least say something to them to verify. This is not rocket science...

Re:How to remove it. The answer.

[Anonymous Coward]

The GSR guy, duh!

Re:How to remove it. The answer.

[hunterx11]

I have actually been sent this, and while you shouldn't run any executable without knowing what it is, the link itself is a link to a PHP page.

Re:How to remove it. The answer.

[TheGSRGuy]

I work in the IT & tech support department for a major university. I see hundreds of students with this infection. The tool has worked every time. If you think I'm not a credible source, that's fine. All I'm saying is that I've run this tool countless times and it has always cleaned the machine.

Re:How to remove it. The answer.

[mikiN]

University...hundreds of students...with this infection.

Zwzwzw, this makes my head spin.
Who was that again talking about declining academic performance?

If you can't trust students not to click some bogus link in an IM, can you trust them not to push a big red button labeled "Emergency Power Off" (in a lab containing a running, very expensive, high performance vacuum pump) because it looks so pretty and shiny? (Trust me, this has happened, perhaps not exactly for the abovementioned reason but definitely not because of an emergency).

Re:How to remove it. The answer.

[Anonymous Coward]

"I work in the IT & tech support department for a major university. I see hundreds of students with this infection. The tool has worked every time. If you think I'm not a credible source, that's fine. All I'm saying is that I've run this tool countless times and it has always cleaned the machine."

Translation:

I am a disgruntled employee working in the IT & tech support department for a major university.
I infect hundreds of students with this rootkit.
The tool has worked every time.
If you think I'm not a credible source, that's fine, I have plenty of other victims.
All I'm saying is that I've run this tool countless times and it always pwns the machine.

Re:Example

[killa62]

hmm, interesting, my antivirus did not detect this...
Shouldn't it be able to detect it because i haven't executed it yet?
i bet this is a fake rootkit

Isn't that the point

[Anonymous Coward]

FTA:

The rootkit is designed to not be detected, and that is the scary part.'"

Re:duh... damn

[mr_z_beeblebrox]

I was going to say that and add that this is definitely scarier than the ones that pop up the message "Would you like to download and install a rootkit". But that would be -1 redundant

only Microsoft Windows affected

[Anonymous Coward]

This affects only users who still use the Microsoft Windows operating system. If you use Linux or Mac OS you are safe.

Just curious

[max born]

"A very nasty bundle is downloaded to your machine" when you click on the worm link ...

Why with anyone write a chat program where you can install (and obviously run) a program just by clicking on a link?

Besides that, in Windows isn't there a way to run programs (like chat) as an innocuous (nobody) user limited only to that user's home directory and with limited write capabilities?

What gives?

Re:Just curious

[heinousjay]

When you click the link, it gets handed off to the registered protocol handler. This will generally be IE, which will offer to 'Open' or 'Save' the resultant file that resides on the other end of the link. Nothing sinister, and certainly not behavior we want to change any time soon.

An 'attack' of this nature could work against any operating system, because it relies on the user downloading and executing the file, which is fairly basic, common behavior across most of computerdom.

Re:Just curious

[QuantumG]

downloading and executing the file, which is fairly basic, common behavior across most of computerdom.

Which is why operating systems should be associating privileges with programs, not users. The age old assumption that the user trusts the software, especially on unix-like platforms, is outmoded. People download and run shit they don't trust. It's a fact of life. The security model should be based around that behaviour.

Clicking on an untrusted executable should run it in a sandbox. The sandbox should provide the program with a virtual filesystem that is isolated from the real filesystem. It should provide the program with a virtual network which the user can review and whitelist/blacklist ports and connections with. Breaking out of the sandbox should be as difficult as possible. Settings for a sandbox should be saved with that program for later invocations.

Re:Just curious

[doxology]

It's called a link. It loads up an external program (a web browser) which then potentially downloads and runs (if its IE) the file.

Re:Just curious

[m50d]

Why with anyone write a chat program where you can install (and obviously run) a program just by clicking on a link?

You want people to be able to send each other links to websites. That's what friends often do. But you want more, if they're fixing up an unreal tournament game they should be able to send each other unreal:// links. If they're going to an irc channel it's nice to let them send each other irc:// links. They might want to discuss a newsgroup, in which case they need to be able to send each other news:// links, and so on. The only logical response to this, and the one AIM adopts, is to hand off any URL to the OS and let it handle it. The problem that arises is that windows uses URLs to do local stuff, and doesn't make any distinction between them - iirc you can run arbitrary installed programs via system:// urls, meaning you might well be able to just make a link which would format someone's harddisk.

Besides that, in Windows isn't there a way to run programs (like chat) as an innocuous (nobody) user limited only to that user's home directory and with limited write capabilities?

Not really. It's getting better but for a long time it was very hard to do this in any useful way, the restricted accounts are too restricted. I'm reasonably security-conscious but gave up using a restricted account, it's just too much hassle. (For comparison I run as user under *nix but don't take the trouble to run my daemons under chroots, which seems to be a similar level of effort)

Re:Example

[rdoger6424]

Ha! I have a Mac! I can't run M$DØ$ apps.
*Thinks smugly to himself*

Yahoo.com and Google.com

[tepples]

How many people still use .com files anyway?

Yahoo.com, Google.com, Fark.com, News.com.com... Windows stores Internet shortcuts in files with the .url suffix, but even when you have "hide file extensions" turned off, Windows still hides the .url suffix, making it nearly impossible to distinguish Google.com from Google.com.url in icon view and difficult in any other view. The little arrow in the corner doesn't mean much, as the Google.com file could contain an icon with the arrow already drawn inside.

Re:Yahoo.com and Google.com

[Al Dimond]

Yeah, why does Windows deliberately disobey your orders when you tell it to show file extensions? There are a few other extensions with this behavior, I believe one of them is .maf (if you have certain versions of Access installed; I ran into this because Mozilla's MAF extension tried to use that as its extension). Anybody know some of these other wierd ones? Is there a way, when programs register an extension with Windows, to get this behavior? If so, WHY!?!?!?!?

Re:Yahoo.com and Google.com

[bcat24]

Shortcuts are handled very strangely in Windows. They are really .lnk files, but Windows goes to great lengths to prevent you from opening them. (IIRC, they are really just special .ini files.)

Re:Yahoo.com and Google.com

[wx327]

You can change these settings in explorer by going to (using the URL internet shortcut as an example):
Tools/Folder Options/File Types/URL/Advanced/Always show extension

Alternatively, you can edit the registry and create the following key:
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\InternetShort cut] (slashcode will probably insert a space somewhere in there)
"AlwaysShowExt"=""

Add a little to it and..

[Tmack]

Who of us actually would click... "Check out these great new pics of us!! LoLz :)"

Add on
"Jenny got drunk and decided to stripteaze!!"
and I bet alot of "us" would...

Tm

Re:Example

[jZnat]

Firefox offers to open it with /usr/bin/wine-safe

Think it's safe?

Haha

[Ecko7889]

GWSks2004: Hey CutiChk3002, there is a worm being spread around on AIM, please click here to protect yourself.

Social engineering....

Re:AIM client, or AIM protocol?

[Kadin2048]

Well this is true, it could just as easily be spread via email or something, but the relation to AIM is that once the virus (trojan, whatever you want to call it) gets into your system, I believe that it sends out messages to all of your contacts with the link, propagating itself.

At least this is how several other IM viruses have been spread. I noticed that just this weekend I got several IMs from people that I haven't talked to in years (but who apparently still have me on their lists) which were nothing but links to .COM or .EXE files.

One of them was being hosted at this address:
http://home.earthlink.net/~two4tea/mc-110-12-00000 80.exe (It has since been removed -- the link is dead)

And I didn't get the other URL that was going around. I downloaded the file and opened it up in a hex editor just out of curiosity (I'm on a Mac so it wasn't possible to execute anyway), but there didn't seem to be any obvious text strings or anything.

What I wonder is how the file got up on that web site to begin with; it seems rather farfetched to believe that a virus could find out that someone has a Earthlink web page and upload itself, then send out that link, which makes me think that the person spreading the virus probably planted it there after somehow gaining access to the account, and then letting the version of the virus which points to that URL out. When the linked file is removed the virus stops propagating, but by then has already spread and nabbed a few unwary users. Unless the program has the capability of 'phoning home' to get the URL of the latest location to send out to everyone, that is. The file was a few hundred KB, so I suppose it's entirely possible that it has that capability; you could fit quite a bit of code into something like that.

Not really my area of expertise, but perhaps someone who knows something more can elaborate on how these things work?

'Rootkit' detection

[dedazo]

OK, I have a beef with this beign called a 'rootkit'; it's really a trojan that can hide itself very well. But anyway. SysInternals has a sort-of 'rootkit' detector called Autoruns that looks at everything that is loaded on to kernel and userspace at boot time. It's extremely useful because it provides an abridged view of what your PC is running when it starts. This is not a 'clik here' end user tool - you have to know what you're looking for. But I used it a few months ago to get rid of a nasty worm on a friend's machine. Might also want to get ProcessExplorer to actually get the cleanup done.

Or... just tell people not to download crap from 'teh interweb'.

Re:'Rootkit' detection

[ninja_assault_kitten]

Autoruns is old technology and is easily by-passed by modern low-level rootkits.

Re:'Rootkit' detection

[dedazo]

Are you talking about the previous version? This new one is far more comprehensible - it even covers TCP providers. I think it's quite complete.

Re:'Rootkit' detection

[detlev409]

If you're looking for Rootkits, why not use the Rootkit Revealer program by the same group?

Spyware Included

[diagonalfish]

The worm also places several spyware and adware applications, including 180Solutions, Zango, the Freepod Toolbar, MaxSearch, Media Gateway and SearchMiracle, the company added.

So, would you like some spyware with your virus at no extra charge? I know this is fairly common, but does this imply that the people that make the viruses are the same ones that make the spyware we have grown to know and love? It seems that the line between "spyware" and "malware/viruses" gets more blurry every day.

Re:Spyware Included

[PinkFreud]

Actually, whomever released this particular worm is likely making money off the installed spyware via a referral-type scheme.

That's how it's usually done with malware nowadays - the authors of spyware typically don't care who is installing their crap on peoples' computers or how they're doing it. A worm author (or just someone releasing it) can sign up for an account with these spyware companies, and simply make sure the account is referenced when the spyware is installed on an unsupecting victim's machine.

It definitely makes one possible route to trace these scumbags.

Re:Spyware Included

[John Hasler]

> I know this is fairly common, but does this imply that the people
> that make the viruses are the same ones that make the spyware we
> have grown to know and love?

No, just distributors for them.

Re:Example

[Phroggy]

Mind elaborating on the example? I'm sure there are plenty here who could say what exactly that was you linked to, I'm not one of them. I'm just happy I'm smart enough not to run it.

I don't have the slightest idea. It looks like a Windows executable. I was sent the link in an IM, presumably by the virus described in the article.

Hey kid, want some candy?

[Kadin2048]

Actually it's more like the old adage about taking candy from strangers. "Here, eat this! You'll like it!"

Most people just don't make the mental connection that they could click on a link -- something they do pretty often and usually without incident -- and cause serious harm to their computer.

I vote that it's more ignorance (to a certain degree self-imposed, because a lot of people could understand a lot more about their computers if they wanted to, but simply choose not to) than a lack of ability or mental capacity.

Re:Hey kid, want some candy?

[macrom]

I vote that it's more ignorance

I still cast my vote on the side of idiocy. My parents know nothing about how a computer works, to the point of calling me and asking where the "on button" is located when the power goes out (and my response is firstly, "where it was the last time you called about locating the 'on button'"). They don't use e-mail frequently, hardly ever chat and only browse a handful of websites. Because of this ignorance of how everything works, they run from things that don't immediately look familiar to them. They correctly delete spam messages from people they don't know (sometimes deleting relavent messages simply because the sender didn't LOOK like someone they knew), they always close popups and never click on strange links. They are ignorant to the ways of the computer, but they're not idiots, so they don't just blindly trudge into something they don't understand. Idiots click random links and reply to spam, etc. because they refuse to acknowledge their ignorance and act as if they know what they're doing.

Re:Hey kid, want some candy?

[InsideTheAsylum]

Uh, if I recall correctly, this worm targets people on your friendslist. In fact, two of my friends were either infected with this or a similar worm and then they IM-spam me with links to said virus. This is like having one of your friends turn out to be a sleeper agent and coming up to you looking normal and smiling and giving you a box saying, "Look! I bought candy, just for you."

Re:Hey kid, want some candy?

[ipfwadm]

My parents know nothing about how a computer works, to the point of calling me and asking where the "on button" is located when the power goes out ... sometimes deleting relavent messages simply because the sender didn't LOOK like someone they knew

Some would argue that that makes them just as much idiots as the people you are deriding.

People who are overly cautious can be just as frustrating as those who are overly zealous.

Re:Hey kid, want some candy?

[BlackTyranny]

Isn't the example more like this? A guy in a uniform is on a street corner, holding a bag and passing something out. He says "Here, try this new Reeses' PB cup. You'll like it!" For 99% of the non-paranoid folks in this world, that's a legitimate, salesman-like friendly thing to do. For the other 1%, that free PB cup could be full of arsenic, or something they're allergic to, or *gasp* have a worm in it. There. That's a better analogy. And I think the odds are a bit more accurate than your example.

wth

[Mr0624]

Seems my article was re-worded. I wish they'd at least show it to me before they post it up.

MOD PARENT UP

[Anonymous Coward]

f'ing editors

Re:Example

[Lehk228]

you go right ahead and run it then o.O

"rootkit"?

[photon317]

Shouldn't that be a WORKGROUP\Administrator-Kit or something? There is no root in Windows. Stop stealing unix terminology you clowns.

Re:"rootkit"?

[bcat24]

I know you're joking, but didn't rootkits originate on *nix operating systems?

Re:"rootkit"?

[Anonymous Coward]

There is no root in Windows.

From Windows, start the command line (or use "Run..."):

c:> dir \

This shows a listing of the files in root.

So clearly there IS a root in Windows.

Re:"rootkit"?

[Anonymous Coward]

C:\ is only one of numerous possible roots in a windows filesystem, each drive appears as a separate device with its own root.

Please refrain from posting retarded comments

[Anonymous Coward]

You can often judge the quality of the articles linked to by /. by their summaries.

The two are pretty much independent. Why can't you have a good article and a bad summary?

Check the definition of root kit before writing such a summary.

The description may seem redundant to you but it's not inherently wrong to define a term. If it were an article about transfinite abelian semigroups I think you'd be glad to see which property of it is relevant to the matter at hand.

iam better than you!

[cycledance]

i have a mac.

Re:iam better than you!

[Slashcrap]

i have a mac.

I know that was probably supposed to be ironic, but it is such a perfect comment. Mac users should use this as their default comment on all online forums from now on. It says the same thing that you're all going to say with a hundred times as many words anyway. And everyone else can use the bandwidth saved to discuss things that they do give a shit about.

Re:iam better than you!

[cycledance]

it wasnt meant to be ironic. my intention really was to get to the point in a second.

totaly blown away after reading TFA

[CaseOfThaMondays]

up until now i thought AIM was a virus, imagine my suprise. well that explains why everyone has complained to me after asking me to clean the spyware off their computer.

Re:duh... damn

[John Hasler]

> ...the ones that pop up the message "Would you like to download and
> install a rootkit".

I expect that would work fairly well.

Root Kit yipes

[Anonymous Coward]

I was worried there for a second then I read the article and found out that the name of the kit ended in .exe ...... who cares, and so whats new.... nothing to see here!

Re:Example

[Red Alastor]

Yes, as long as you don't value what's in your home directory.

Idiots

[Azerious]

If you bother to upgrade to newer versions of windows, SP2 will ask you if you want to open or download the file, which is usually called something like http://12.234.426.43/picofme.jpg but it tells you this is an executable, so if you are still dumb enough to run it after it tells you "Hey! I'm an executable hiding as a jpeg", then you deserve to be infected and so do your friends.

Re:Idiots

[The Cisco Kid]

If you are still dumb enough to use MS software for anything remotely related to the Internet, you deserve to be infected and so do all your friends.

*WHY* is "yet another windows vulnerability/exploit/bug found" even *remotely* "news" ? Same Shit, Different Day. Anyone who is remotely surprised by the fact that 'Yes, Windows is still swiss cheese, despite copius and ongoing FUD from MS' is a complete and utter moron.

Re:Idiots

[Darth_brooks]

So tell me, when you go out to dinner, do you get a seat for your smug sense of self satisfaction too?

Take a minute and read the article. The worm travels via AIM and requires user interaction to execute. You could craft the same type attack with GAIM against OpenBSD running in VMware, inside a room with Biomtric locks. A network is only as secure as its weakest link, and this particular rootkit strikes the weakest link of all. Users.

But hey, you're right. This one is totally on Microsoft. They're clearly to blame for shitty AIM code and users that are dumb enough to click every link they get.

Re:Idiots

[The Cisco Kid]

The windows worm would execute on OpenBSD? Riiiiight..

Re:Idiots

[Anonymous Coward]

Wow, you're incredibly astute at missing the point. It's like here's the point, and here's you:

--(point)-->

(you)

Woosh!

Re:Idiots

[ZachPruckowski]

No, but the point is that this isn't Microsoft's fault, not entirely at least. No matter the intelligence of the operating system writers, you can't write a system that is immune to someone who wants to screw it up. The operating system can warn people, but if they insist on clicking on something dodgy, they're screwed. The grandparent was trying to illustrate the fact that the virus could easily be rewritten to have the same effect on other operating systems. As long as users ignore warnings and download fishy things, these virii will exist. Sure Windows has a lot of anti-virus and security stuff to do, but this isn't their fault, not entirely.

Re:Idiots

[The Cisco Kid]

True, but it seems like most users that are too stupid to know better, are the same ones that arent even aware of the existence of anything other than windows, let alone actually use something else.

And I take issue with the whole idea that 'clicking on something' can run some arbitary program in the first place. Making the entire file system appear as GUI folders and icons is part of the problem in the first place.

Re:Idiots

[Creepy Crawler]

Nonono, it's http://www.mypictures.com/coolpic.jpg

(hint: look at linky)

Re:Idiots

[jcr]

So tell me, when you go out to dinner, do you get a seat for your smug sense of self satisfaction too?

How do you infer smugness from his keen grasp of the obvious?

-jcr

Re:Idiots

[glesga_kiss]

"Hey! I'm an executable hiding as a jpeg", then you deserve to be infected and so do your friends.

"What's an executable?" - Your mom.

Re:Idiots

[Dark007]

Sometimes it's not feasible to upgrade to SP2. For instance, once installed, my computer seems to hang on startup just after the icons appear and will not respond. After about 5 minutes it is reponsive. I tried uninstalling SP2 and reinstalling and the same behaviour happened. If you remember back when SP2 came out a lot of companies held off installing it because it was a such a huge change to a whole network of PCs. This will happen in the future with other updates.

Re:Idiots

[Azerious]

Even non service pack 2 xp machines should tell you what type of file it is you are downloading when it gives you the option to save or open, but I could possibly be wrong.

Re:so, i, for example, work in politics

[macsox]

well, at least the constitution affords me the ability to find out who precisely my anonymous accuser is in a court of law. or is there an Anonymous Coward clause in the patriot act?

Some viruses DO run on WINE

[killa62]

Some windows viruses do run under WINE. However, they do not affect the system to the extent that windows viruses affect windows systems. They RUN, but mostly nothing else happens other than wasting CPU cycles.

I think this was posted on /. before.
http://os.newsforge.com/article.pl?sid=05/01/25/14 30222&from=rss

Re:Some viruses DO run on WINE

[Psykosys]

When are they going to get around to full virus support? (I'm sticking with Windows 'til then.)

Re:Some viruses DO run on WINE

[kasperd]

I think this was posted on /. before.

I don't know if that particular survey was posted on slashdot. However another story about someone having much more success with running KLEZ on WINE was posted on slashdot. Unfortunately none of the mirrors of the article works anymore. But maybe it can be found on google if you use the right keywords.

Re:Some viruses DO run on WINE

[cerberusss]

The article text was posted as a comment to that story.

Re:Some viruses DO run on WINE

[Sun Rider]

Which gives me an idea, why not run Wine on Windows? No more viruses!

They don't know what an "executable" is

[CustomDesigned]

Now, the question is whether people who get infected learn their lesson...that's what I'd like to see.

The key knowledge non computer geek (but otherwise intelligent) people lack is which files are executables. Frankly, not having used Windows since 1995, I am a little behind on that subject myself. So you've learned that JPG and MP3 and passive formats, and safe to click on. Who would'a thought that SCR wasn't? It helps if your browser accurately distinguishes between executable and passive content. Even passive content can be dangerous when your "player" has a buffer overflow type bug.

Re:They don't know what an "executable" is

[Thalagyrt]

Actually, with the GDI+ bug last year, which Microsoft has fixed in XP SP2, it's possible for a JPEG to contain executable code. There's plenty of people not running XP SP2 though.

Here's the Microsoft article on it: http://www.microsoft.com/technet/security/bulletin /MS04-028.mspx

Re:Designed not to be detected - as compared to...

[LurkerXXX]

So, before posting a ill-informed summary, they should check first as a reference a 'encyclopedia' that lets 12-year olds edit and delete stuff posted by Ph.D.'s working in the field?

And your hoping for competence???

Re:Rootkit designed not to be detected you say?

[Mysticalfruit]

I was thinking the same thing... You'd open Add/Remove programs and under installed programs would be something like "j00 l33t R00t|<1t" with a remove tab...

Though one of my friends whose pretty low on the totem pole in terms of computer literacy up and started sending me links that went to an executable... mc-{something}.exe A quick googelization told me it was some trojan/malware that takes your machine over and then attempts to send the link to everybody on your buddylist.

Though after that first day she disappeared off of IM. So either AOL got wise and started proactively looking for this and locking out those accounts or whatever it was drove her machine into the ground... My bets on the latter...

Fox guarding the henhouse?

[jbn-o]

Using a proprietary program (as RootkitRevealer looks to be) to fight the ill effects of another proprietary program (such as AIM chat software) sounds unwise to me.

Re:Fox guarding the henhouse?

[LiquidCoooled]

SysInternals have a proven record in the industry for producing reliable well thought out utilities.
If you read the page linked, even they suggest RootkitRevealer is not the end all solution, and a scan from outside the running system (with a boot CD).

Use their site and utilities as a resource, the linked page gives plenty of information and outside links, but never rely 100% on any one provider.

Re:Fox guarding the henhouse?

[jbn-o]

Proven by whom, using what source code? And can you answer this without argument by authority?

Re:hah

[rm999]

In the case of AIM, I am pretty sure you have to click a link. And I stand by my opinion, regardless of what the moderators think :)

The truth

[paulius_g]

Is this another reason to switch? (Linux or Mac, I don't care)
Or even use another client? (Miranda or GAIM)

Hail Windows! Security holes galore.

Re:The truth

[Anonymous Coward]

Microsoft doesn't have exclusive rights to software bugs ;-p

Search securityfocus.com for 'gaim' and you find 146 vulnerabilities.

http://www.securityfocus.com/swsearch?sbm=%2F&meta name=alldoc&query=gaim&x=0&y=0

Or there are the amusing ones in the *nix world where there are possible overflow issues with such utilities as 'strings', and of course libraries for reading jpegs.

Hail Computers! Security holes galore.

Re:Example

[Anonymous Coward]

mod parent redundant

Two Real-world Examples

[Kadin2048]

I received several IMs in one night a few days ago from people on my buddy list that were just URLs to executable files; they tended to be identical messages sent every 10 minutes or so and there would not be any response when I messaged them. Here are a two examples from the iChat log (the names have been removed):

10/28/05, 12:07 AM
[buddy1]: load http://home.earthlink.net/~two4tea/mc-110-12-00000 80.exe mc-110-12-0000080.exe 1 -s

No real attempt at subtlety there, just "load" ... I have no idea what the "1 -s" flags are all about either, perhaps someone can explain? This doesn't look as much like a social-engineering exploit ("Check this out!!1 [link]") as it does an attempt to actually issue some sort of command to the remote machine, although I assume (hope?) that's impossible, even on Windows.

10/28/05, 6:41 PM
[buddy2]: http://home.earthlink.net/~icebaby123/PIC0400.com
  [buddy2] has gone offline.

This link is also now dead, thankfully; however the behavior of the sender was slightly different. Rather than sending the same message multiple times they instead sent just the link alone and then signed off rapidly. This second one is behavior I've seen before so I don't think it's a new worm, the command-like structure of the first one though is something I haven't seen -- although it's not as if I really have spent any time looking into this. It was just a new one on me though, which is why I bothered to download the file and look through it with a hex editor, although to my untrained eyes there wasn't anything interesting to see in there.

Re:Two Real-world Examples

[mrchaotica]

...an attempt to actually issue some sort of command to the remote machine, although I assume (hope?) that's impossible, even on Windows.

Maybe it's exploiting a flaw in AIM, or is part of this (or some other) rootkit and the command program is sniffing packets on whatever port AIM runs on.

super user problem too?

[Anonymous Coward]

When you click the link, it gets handed off to the registered protocol handler. This will generally be IE, which will offer to 'Open' or 'Save' the resultant file that resides on the other end of the link.

On an Unix-type OS you have to save it first and then do a "chmod +x". Even then you usually have limited access to the rest of the computer. Microsoft seems to have everybody run as "root" which I think is a big part of the problem.

I'm a little cynical

[glowworm]

First the warning was made by a company that sells IM prection software, but more so because the whole purpose of a rootkit is to be very secretive. To not let the infected party know that they are compromised is probably foremost in the authors mind.

If the infected package also adds spyware and hijacks the homepage isn't that drawing attention to the fact the machine is compromised a little too much, and therefore isn't it likely to be a pretty short lived infection in darwinian terms?

IMHO Someone who spends effort and time to slip under the radar is not going to waste time adding 180 and its ilk to the machine and ruin their newfound method of infection.

A compromised machine is just far too valuable to only deliver advertisments.

Re:I'm a little cynical

[mikiN]

IMHO Someone who spends effort and time to slip under the radar is not going to waste time adding 180 and its ilk to the machine and ruin their newfound method of infection.

Perhaps because this is just an example of a less sophisticated worm? To draw attention away from the millions of more advanced worms lying dormant in that many infected PCs, waiting to do their thing on, say, 06/06/06?

Re:AIM client, or AIM protocol?

[Anonymous Coward]

It really depends on the client. I use GAIM, but I know i'm impervious to this, because I'm on a linux system; .COM files won't run under linux unless you get something like WINE, and run the console extension. One of the great things about Linux is that while it doesn't support Windows programs (Excepting WINE, Cedega, etc) that people might like (Word, Excel, I dunno!) it doesn't support Windows Malware as well. I guess what I'm trying to say is that the rootkit is made for the Windows platform; because of this, it will not run under any POSIX-Compliant system (Again, excepting the ones with WINE installed).

It's not that bad.....

[Ryanpete]

Yes this worm propagates extremely fast but I've personally dealt with it and after infecting myself on purpose to discover the changes, it's actually pretty simple to remove....

Re:Example

[Sheetrock]

I downloaded it with wget (don't use a web browser to download things that exploit web browser vulnerabilities) and used the filesize (109568) to search for it on Google. Came up with a page on Trend Micro saying it's WORM_AGOBOT.AIM.

Re:Example

[The Cisco Kid]

Downloaded it. So now I have a file that appears to be meaningless binary gibberish. (AKA "Application/OCTET-STREAM") How does one 'run' such a file? I can't seem to find a Makefile, or any other way to compile it. I guess I don't quite get what is dangerous about it?

MODERATE UP PARENT: Insightful (n/t)

[Mostly a lurker]

n/t

Re:AIM client, or AIM protocol?

[mrchaotica]

I downloaded the file and opened it up in a hex editor just out of curiosity (I'm on a Mac so it wasn't possible to execute anyway), but there didn't seem to be any obvious text strings or anything.

By the way, if you just want to see if the file contains any obvious text strings, you can just run strings on it instead of manually reading through it in a hex editor.

Im worried..

[Anonymous Coward]

Can this root thingy thing attack my nintendo ds?

duh indeed

[Anonymous Coward]

A bit obvious... Just like some viruses were doing 10 years ago... Hardly news. It's just hooking some APIs (instead of interrupts like back then), big f'n deal. Next thing you know, they'll say how they try to hide themselves from being running in memory... Typical GRC lame stuff.

Re:Designed not to be detected - as compared to...

[Anonymous Coward]

One would hope that at least story submitters are more competent than the average journalist

You must be new here ;)

been here before

[jordan]

we warned them once , we warned them twice .

silly AOL, will they ever listen?

FDisk in 2005?

[Anonymous Coward]

I had a rootkit last month. Nothing could get rid of it but a full fdisk/mbr where I lost everything. It was MBR based and would append itself when running windows which made it nearly impossible to delete.

It's 2005 and you only tried FDisk? There's a number of free boot record editors that could have fixed anything. There is no rootkit that I know of that is based out of the MBR the way the old Pakistani virus did to Apples. If I have a customer who needs data recovered off a rootkit infected computer I put it in as a slave in a WXP or W2K system.

Re:FDisk in 2005?

[Anonymous Coward]

One of the rootkits out there puts autorun files in C:\.
If you plug it into a second W2K computer as a slave, it infects
that one. Hard-disk to hard-disk virus!

Re:FDisk in 2005?

[wheany]

That's just one more reason to turn off autorun.

Re:FDisk in 2005?

[mstromb]

Which is one of the reasons why autorun is one of the most insecure things about windows. Yay for randomly running arbitrary commands from unknown sources!

Unfortunately, if you turn it off, anyone else using you computer becomes incredibly confused as to why windows "doesn't work".

Also, I've run fdisk /mbr on windows xp machines in the past (fixing botched dual boot attempts), and not had an issue. As far as I know, that command simply resets the MBR to the deafult value - that is, run ntoskern or whatever on block 0 of partition 0. More or less. Or is that completely wrong?

Re:FDisk in 2005?

[m50d]

Everything runs in circles. I remember the days when the main way you infected things was having another disk (hard or floppy) in while you booted.

Re:FDisk in 2005?

[clymere]

Using a clean windows machine to fix an infected windows drive isn't all that smart in the first place. This is an area where live disks excel, Knoppix being the obvious first choice...not to mention the many variants with more specialized tools added on. You're running a different OS, its running off of read-only media, and you're risking essentially nothing.

Re:FDisk in 2005?

[bhtooefr]

Unfortunately, if you turn it off, anyone else using you computer becomes incredibly confused as to why windows "doesn't work".

That's a disadvantage?

Re:FDisk in 2005?

[roadrunnerro]

Actually he could have used the OS boot CD directly...

Re:FDisk in 2005?

[Billly Gates]

Tried that.

Still got reinfected because a restore cd wont fdisk /mbr the infected data. Spyware makers do this so even a complete windows reinstallation wont clean off their warez.

To me that is pure evil

Re:FDisk in 2005?

[roadrunnerro]

Hmm - so if this would have been XP fixboot/fixmbr _wouldn't_ have solved it?

Why doesn't AIM block executable attachments?

[oasisbob]

When I was working on developing a Snort rule to detect links to .pif attachments in MSN messages, I was surprised to learn that Microsoft would quietly discard any messages which contained a link to suspicious executables. It even blocked links to fake .pif files I hosted myself, so it wasn't a URL blacklist.

Why won't AOL do the same with AIM? This is a very effective measure to help stop this type of attack. I work at the resnet for my university, and these types of worms are very annoying to help students deal with. Using Snort last year, I was able to see that over 1/3 of all students who received a particular "OMG click this link!" email clicked it, became infected, and started to spew messages to the infected file.

Blocking the messages before they even arrive is by far the most effective way to stop this infection vector. I'm hard-pressed to think of a reason why this is a bad idea.

Re:Why doesn't AIM block executable attachments?

[Slashcrap]

Why won't AOL do the same with AIM?

Easy - it would take away their ability to send screen savers to each other.

Without screen savers they have nothing! They would sink into a pit of darkness and despair. Do you really want to be responsible for all the suicides?

Re:Why doesn't AIM block executable attachments?

[glesga_kiss]

I was surprised to learn that Microsoft would quietly discard any messages which contained a link to suspicious executables. It even blocked links to fake .pif files I hosted myself, so it wasn't a URL blacklist.

Not entirely correct, from my own experience. What I've seen, in both Office Outlook and Outlook Express, is that you get the message "Outlook has blocked access to a potentially damaging attachment" and the attachment is simply not available. There is nothing you can do to get it back, short of hacking the registry or getting your Exchange server config changed to allow it. Or use webmail to get on your IMAP server directly... >:-)

Following this, many trojan writers started to zip the binaries to get them through Outlook. This still works; blocking an exe isn't too bad, but blocking zip would be a major PITA for email.

Blocking the messages before they even arrive is by far the most effective way to stop this infection vector. I'm hard-pressed to think of a reason why this is a bad idea.

"Thank you for purchacing our software, your order ID is 1234. Please click on setup.exe to install your software". There is no reason why you should not trust exe's you requested. The Outlook block annoys me at least 3 or 4 times a year, when someone wants to sent a binary to you. Need to explain to some of them on how to make a zip of it (and why they need to redo it in the first place).

Re:Why doesn't AIM block executable attachments?

[SirPavlova]

The idea is good. However, the first build of MSNM they put that .pif filtering in was hilariously over-zealous: in a three-way chat or more, if anyone said ".pif" anywhere, it would throw you out of the conversation. So, to throw (potentially) everyone out of it, all you had to type was:

.pif

Unfortunately my friends tend not to update very often. I could've had a lot of fun, but I only got to throw myself out most of the time.

There really is a *nix under the hood afterall

[ferretous]

I tried to login as root on my windoze box but it wouldn't let me. Does that mean I have already been infected (or should that read rooted)?

Incredibly easy to detect and remove...

[detlev409]

The worm (or trojan horse or whatever) is always named lockx.exe. I work at a help desk, and I can tell you from experience that it's incredibly easy to detect and remove (at least, in this incarnation). Lockx is almost always in the root directory, and when it's not there, I've actually seen it placed on the desktop. I'm not sure if it's just the weirdass users on my campus or what, but those are just about the only places I ever see it.

Removal is simple, just download Jay Loden's Aimfix, run it in safe mode, delete the EliteToolBar adware from the Windows directory, and check your startups. Removal takes about 5 minutes, tops.

Re:Incredibly easy to detect and remove...

[pe1chl]

How can a user process create files in the root directory?
Must be some mis-configuration?

Re:Incredibly easy to detect and remove...

[jayloden]

This story has had me rather bemused for some time now...I've had lockx.exe in the AIMFix removal definitions for quite a while. I haven't looked in my cvs log for AIMFix to check, but I'd guesstimate somewhere around a month. Maybe I need to start doing press releases :)

I wrote a journal post recently about some of the experiences I had with other AIM-based rootkit infections, as well. The nastiest one I've seen so far has been pokapoka/elitebar, which is an enormous pain in the rear to remove (also closely related to lockx). As far as I know, the only way (without using a boot disk) to remove this crap is to boot into Safe Mode, run AIMFix - or manually remove any known virus/worm files - and then delete the entire C:\Windows\etb directory, which is where PokaPoka and Elitebar sticks its infector files. I maintain a Safe Mode instructions page for helping end users get into Safe Mode as well, which is often helpful.

I've been working to remove AIM viruses since 2003, and my software, AIMFix, is used by Universities and individuals all over the country. See the users page if you're interested in who uses AIMFix (that I know of, at least). I've seen this stuff progress from simple exe files that run at startup to rootkits that are almost impossible to remove for most normal users. I switched to Linux for all my computer needs in 2004, but I've continued to maintain AIMFix. It's now cross-compiled with mingw for Win32 platforms on my Linux box, and I use VMWare for testing and analysis. I keep doing it simply because it helps so many people. I'd rather not have to take my free time and spend it hunting down virus variants, and answering email, but it's worth it to help people out here and there.

-Jay

Re:Incredibly easy to detect and remove...

[detlev409]

Since I'm not likely to get another opportunity, let me just say a big thank you from all of the people at my helpdesk. The aimfix tool saves our bacon every time the AIM virus goes through a new variation (which happens just about once a month on our campus).

Seriously, thanks a ton.

Re:Incredibly easy to detect and remove...

[jayloden]

No problem, glad to help :) You're more than welcome. By the way, if you run into a new variant that AIMFix misses, contact me through my contact form and send me a HijackThis log from the infected machine and I'll be happy to try and get some updates out for you. -Jay

HA!

[tjlsmith]

*I* pressed the shiny red button and noth@#$@#$##)(*)()_(NO CARRIER

About the rootkit

[nightcrawler77]

This looks like the same worm a friend of mine got a few weeks ago. I loaded it up in VMWare and discovered that it installed, among other things, the "FU" rootkit.

I took a rootkit class at this year's Black Hat Training from the guy who wrote FU. He pointed out that it's more of a proof-of-concept rootkit. It does allow you to hide files, registry keys and drivers from both user-mode and kernel-mode processes, but, it really doesn't go out of its way to hide itself from every possible angle, so detection (and thankfully, removal) wasn't that bad.

I was able to whip up a little app to fix it from within Windows. But had the worm's author actually expanded on FU's techniques and done a better job of hiding the rootkit, recovery would not have been as nearly as easy. (Just imagine how much fun would it be to talk a novice through Windows XP's Recovery Console!)

Once the worm authors start to get better at exploiting the potential of rootkits, we've definitely got a much better problem on our hands. The old "1. get infected, 2. run anti-virus to disinfect, 3. repeat" cycle just won't work anymore. Good luck even finding a well-implemented rootkit once it's in your kernel, let alone trying to clean it up while it's effectively able to veto every action you take.

(Yet another reason why no Windows user should run as an Administrator.)

Re:About the rootkit

[Creepy Crawler]

Yeah, and knowing the RPC bugs allowing priveledge escalation is going to help?

Norton pops up due to "virus pinfi", backdoor attaches to Administrator window, and poof goes your system.

XWindows isnt much better, but at least has multi-user built in (and a multitude of stuff to stop naughty windows).

Re:About the rootkit

[Johnno74]

Microsoft has ALWAYS said processes running with elevated priviledges such as localsystem should NOT display any UI, because its not that hard for an app to subvert another app running in the same desktop context.

I don't think norton's is vulnerable to this particular problem, AFAIK the window that pops up is running under the same context as the logged on user.

This is the same thing that chris paiget(sp?) puplicised with his "shatters" attacks, which posted an invalid message to a windows message queue that contained a callback to a function defined in the data that was sent to the message queue.

Re:About the rootkit

[Gta-Klue]

that's not true. If I'm running a virus scan as "Administrator" and a infected file is found, within norton I CAN NOT
remove that file. Why is that?

Woot! - root

[Anonymous Coward]

And you will be logged in as root when you run wine?

IE and i.e.

[stonedonkey]

IE: The worm is a compact, surreptitious BT/Kademlia client.

Took me a second to realize that "IE" meant "id est" and not Internet Explorer. And "id est" means "that is," not "for example," also known as e.g. (exempli gratia).

Handy cheat sheet:

i.e. = id est = that is (not commonly captitalized, or puncuated as an acronym like IE)

e.g. = exempli gratia = for example

There's your pendantic lesson of the day :p

Re:IE and i.e.

[Anonymous Coward]

There's your pendantic lesson of the day :p

yeah youre a regular pendant

Re:IE and i.e.

[PakProtector]

IE: The worm is a compact, surreptitious BT/Kademlia client.

Took me a second to realize that "IE" meant "id est" and not Internet Explorer. And "id est" means "that is," not "for example," also known as e.g. (exempli gratia).

Handy cheat sheet:

i.e. = id est = that is (not commonly captitalized, or puncuated as an acronym like IE)

e.g. = exempli gratia = for example

There's your pendantic lesson of the day :p

Now, let me pedanticly correct you. I.e. does indeed stand for 'id est,' but 'id est' does not mean 'that is.' 'id est' is latin for 'it is.' I know this, because I speak the bloody language. Thank you.

Re:IE and i.e.

[Anonymous Coward]

Why did you feel the need to explain that? I'm sure everyone with even a modicum of intelligence knows that.

Re:IE and i.e.

[Anonymous Coward]

"pendantic"? Oh, man... Almost out the door on an otherwise good post, and then this... (lose the first 'n' and you're correct)

Re:IE and i.e.

[suwain_2]

This aren't "real" translations, but I find this to be easier to remember:

i.e. = "in effect" ("in other words")
e.g. = "example given"

Just think of it as a handy mnemonic device as opposed to literal translations.

Re:IE and i.e.

[kisrael]

My memory aid is a little odder, but is better geared to my mind: (I think my subconcsious mind came up with this actually)

e.g. = for example.
--remembered because the "f" in "for example" is the letter between e and g
i.e. = that is
--remembered because the "i" matches the "i" in "that is"...there's no "i" at all in "for example"

This may seem a little clutzy at first, but its incredibly easy to rewire your brain to follow.

Re:IE and i.e.

[djimi]

N.B. Latin is dead

Re:IE and i.e.

[BandwidthHog]

Now, let me pedanticly correct you. I.e. does indeed stand for 'id est,' but 'id est' does not mean 'that is.' 'id est' is latin for 'it is.' I know this, because I speak the bloody language. Thank you.

Umm, was that intended to be ironic?

Because the adverb form of the word is pedantically

Re:IE and i.e.

[lordofthechia]

" N.B. Latin is dead"

Bah, guess there's no reason to finish this localized latin build of BSD I was working on...

Re:IE and i.e.

[Anonymous Coward]

id est DOES mean "that is." In Latin, is, ea, id can mean "this," "that," "he," "she," or "it" depending on gender.

Re:IE and i.e.

[Anonymous Coward]

how about: e.g. = eggsample :)

Who of us actually would click...Candy Man.

[Anonymous Coward]

"Hey, you don't know me, but I just KNOW you'll love what I have in this box. Go ahead, take it home and open it."

Sounds like every guys pickup line.

Re:uninterested does not equal idiot

[uvajed_ekil]

If computers were as well-evolved as some of us like to think they are, you wouldn't need to be an expert to use on for simple day-to-day tasks. Most people just want to be able to do their banking/news reading/pr0n viewing/email online and be able to type a letter when needed and have no desire to learn about linux or how to protect themselves from every new type of malicious attack. It really shouldn't be so hard or time consuming to operate a simple home PC. I enjoy being informed, but most people just want a machine that works. Maybe the end users are not the idiots, so much as the designers are. How many years of development have gone into these machines/operating systems that are so vulnerable to so many threats? Maybe the average PC shouldn't be capable of playing Halflife5 or BF4 at 1192FPS at a resolution of 23902 x 9856, but why can't it run a browser, a word processor and an email app without fear of it becoming a zombie? Sean just my opinion

No people are idiots

[SmallFurryCreature]

Although perhaps it depends on how you define "idiot".

It is not just that these people do not have a complete understanding of computers and how to operate them. These people would also fall for trojans/spyware in real life. Like happily giving all their personal details to anyone who asks and then wondering why they get so much junkmail. What to think of pyramid schemes or false lotteries?

A non-idiot will always ask himself, why is person X offering to do something for me? Why does the supermarket offer me lower prices if I signup for a free card with my personal details attached? Exactly what is the math behind these pyramid schemes and can anyone not involved at the very beginning ever make money of it? Roulette, so what is the size of my house vs the house of the casino owner?

Same with virusses/rootkits/goatse links, why would someone send me a random link?

I think an idiot is a person who does not receive warning signals. HOT LESBIAN TEENAGE CO-ED ANIMAL HENTAI SEX FULL DVD.exe to them promisses some weird sex. They do not find it odd that the file is less then 1 mb. They simply do not think.

It has nothing to do with computer literacy. It is just common sense. Normal people have it, idiots don't.

You are SO off my buddy list

[AgentPhunk]

So anyone who gets infected automatically qualifies for this t-shirt

Antivirus solutions on Linux

[kahrytan]

Bitdefender Linux Edition. It is a freeware so it is freely downloaded at bitdefender.com
  Linspire VirusScan. Linspire exclusive that costs $30 a year or $20 for their CNR members.
  ClamAV is another Open Source antivirus solution.Available at clamav.net. This one isn't for the average consumer but allows you to create your own signature for a new virus.

  Linux also has number of firewalls. Most just configure ipchains. Guarddog is one such linux program.

Re:uninterested does not equal idiot

[bhtooefr]

Here's the box you need, then:

http://www.amd.com/us-en/ConnectivitySolutions/Pro ductInformation/0,,50_2330_12264,00.html?redir=PCP C01

Buy one at RadioShack for $300.

Yes, it's overpriced. However, considering that it's nearly impossible* to infect...

* I'd say impossible, considering the DRM they've got on the thing, and the fact that it's Windows CE-based, yet not Windows CE, so it's also a very obscure OS that exactly one model of device uses, but nothing's impossible when it comes to computers.

That's a relief

[instantgames]

At first, I thought the article said, "swiftly spreading AIM to many computers."
Now that would be dangerous.

"Root kit"? NOT!

[Anonymous Coward]

At first I thought this was a Linux (or similar) problem. It turns out that this is just yet another Windows worm.

Windows doesn't have "root"... This isn't a root-kit.

said FaceTime, which sells products to protect IMs

[iion_tichy]

so let's all be scared and buy lots and lots of FaceTime products!

Wheres that rootkit?

[martoQ]

The rootkit is designed to not be detected, and that is the scary part. As opposed to all those rootkits that ARE designed to be detected?

a serious ethical question:

[Hosiah]

Should loosening an AOL chat virus even be considered a crime? This is given that it sticks *only* to computers running AIM. Consider that there is virtually nothing on AIM but bots and script kiddies and cyber perverts, anyway, so, in fact, one might even be doing a public service knocking them all offline for a few hours. This is like if I hear somebody hacked a spam site and shut them down - Hooray! Vigilante Justice! Seems a great expenditure of effort going to waste, however, if AOL recovers from the attack.

Re:a serious ethical question:

[megabyte405]

I do hope that your sarcasm is too subtle to be apparent - many, many people use AIM.

Re:a serious ethical question:

[Hosiah]

many, many people use AIM.

Really? Name names. I tried to use AIM extensively for about six months (back in my Windows days, just to see what all the rage was about), and found nothing in ANY room in the system but bots and cybersex; cybersex and bots; bots and cybersex; cybersex and bots. God, I remember the damn bots started hitting on each other, even! Name a single AOL chat room that has neither "A/S/L?" or "Hot pictures of college girlz - see my webcam!" as one of the first lines that automatically hit the screen upon first login.

You can tell me Windows is catching up to Linux in security, and I'll say , "Emmm, maybe". You can tell me Sun's gonna Open-Source and Community-License Java, and I'll think that was some time coming. You can claim that BSD and BeOS are gonna combine forces and take over 98% of desktops next year, and I'll say "Sounds like a long shot..." But when you tell me, with a straight face and clear conscience, that anything has ever transpired in any AOL chat since the day the beast was created that is anything less than a pimple on the hairy mole of the warty zit of the infected, puss-dripping scab on the ass of anything-good-at-all, and my only thought is, "How the hell did this person even FIND Slashdot???"

Re:a serious ethical question:

[megabyte405]

Ahh, there's the difference. AOL chats are full of bots and cybersex, you are correct. AOL Instant Messenger (one on one chat) is used by a lot of normal folks, though, and many teenagers as well, even those who are not bots.

World of Warcraft

[Kagami001]

For anyone curious, WoW runs fine in a limited user account as long as that account has write privileges to the executable folder and files to allow updates. It also doesn't require any HKLM settings to run, so you don't need to even run the installer on your system, you just need the files it unpacks. (I used VMware to run the installer.)

I'm not sure games that require arbitrary patching of files on someone else's (Blizzard's) schedule are all that much easier to implement in any other OS, though. A separate copy of all the game files for each user would be prohibitively large, but giving all players write access to the executable directory allows any single user to bork the whole thing if they feel like it. (Not an issue if only one user has access to play that game, but.) The only other option with current security and file-system models is to have a privileged updater executable, and then you'd have to be trusting some updater application from Blizzard with root privs on a regular basis. Either that, or Blizzard would have to get its updates approved for addition to the distribution's package repository every time they wanted to update their game.

I'm already not a big fan of the way adding software to Linux and Windows systems requires full root privs as a matter of course. Most software only needs rights to write to one specified directory and add an entry to a list of installed software; why the heck should I have to give the installer full control of the system?

"Run As" is the same in Pro and Home

[Kagami001]

There is no difference in the behavior of the "Run As" function between XP Professional and XP Home Edition.

Worms don't Infect "Computers"

[andydread]

Worms don't infect computers they infect operating systems. when will people ever realize this? The title should be "worm infects windows" or "worm infects Linux or OSX" or whatever. So people, wake up!!!!

From the Register:

[Anonymous Coward]

Sdbot-ADD, the latest variant of a family of worms that is continuously modified with new components by hackers, comes complete with an adware bundle and a rootkit file, lockx.exe.

Why aren't the executives of the companies whose wares are advertised by the adware in prison? Seems easy enough for the cops to find them, and just about every country has laws against burglary and vandalism.

The police of all countries are not doing their jobs. Lets see some CEOs and CIOs in fucking prison where they belong.

(MRC="leftist")

I don't speak dead languages

[Anonymous Coward]

I speak English. I.e. = "In Essense," a 100% English (ok, American) phrase.

Why in the hell would anybody use an acronym of two incredibly short words in a dead language if they're trying to communicate?

That's obfuscation, not communication; i.e., how politicians talk.

Dumbasses.

(MRC="dimming")

only 10Mbit?

[teknickle]

Hey, kid. Upgrade to Token Ring!
We cycle around at 16Mbit! ;)

(yeah, I know you mean fractional T3/DS3)
(oh, and TR runs at 4/16 with HSTR at 100Mbit--just for y'all who call it 'broken ring')

Personally...

[infinite9]

Personally, I like when they pop up like that.

And with firefox, you get to touch a mouse, but with a woman, you get to touch a cat. (meow)

-1 redundant

[messju]

'The rootkit is designed to not be detected, and that is the scary part.'
If it wasn't designed to do so, it would not be a rootkit.

I can assume once again, My OS X Mac is solid?

[Anonymous Coward]

Ok root kits are possible on OS X, but i think the Apple configuration holds them at bay. And this is an .exe file. So once again, windows users sit around with gazed eyes in corporate America, and wait for the "computer guy" to show up.

Let see, how high will Apple stock go this week? :-)

Lots of family members got infected here too

[Solr_Flare]

I've cleaned this off of 3 family member's computers so far as well. Another lost their entire computer before it could be taken off their system. In all cases what happened was another family member got infected then started automatically messaging everyone on the machine's friend's list. Since the computer was often used by a younger child, the social engineering worked exceptionally well in this case and most everyone clicked the link.

Regardless, if you follow the usual procaution of being careful what you click and have virus protection, you'll be ok. Still, this is one mean little virus if it does get in your system.

menomic Re:IE and i.e.

[Anonymous Coward]

I remember that by thinking i.e. means "In other words"

And e.g. as EGsample.

A little harder that that.

[abb3w]

Sure a woman can block pop ups, all she has to do is giggle.

Not quite that simple; she has to point and giggle.

incompetence?

[Anonymous Coward]

incompentant => incompetent

your => you're
(your indicates possession, you're is short for "you are")
e.g. "You're responsible if your dog gets off its chain and bites somebody."

I know not everyone on Slashdot has English as their first language, but misuses of your/you're must be attacked at every opportunity, or we are all surely doomed.

Bear in mind...

[abb3w]

Rule #1 when dealing with rootkits (or other break-ins)... The system can no longer be trusted. That means any and all executables on the system are suspect (including System Restore functionality) and may have been tampered with.
[...]
-Boot a Knoppix CD/DVD and fingerprint your system regularly for a baseline to compare against at a future date.

Note that Rule #1 means NO file on the system can be trusted. Therefore the system fingerprint needs to be stored on removable media, with removable write-once/read-many media preferred.

Re:Designed not to be detected - as compared to...

[gknoy]

[T]hey should check first as a reference a 'encyclopedia' that lets 12-year olds edit and delete stuff posted by Ph.D.'s working in the field?

And your hoping for competence???

I am neither a 12 year old nor a Ph.D. :)

My experiences with Wikipedia (tried to add a friend to an alumni list at his university ;)) have shown me that some pages with any useful information have someone that has chosen to be its caretaker. Yes, the 12 year old can make changes, say that red is blue or that Mr. Rogers was a Navy Seal. However, soon (usually within a few hours), that Ph.D (or bored grad student, or zealous historian of Mr. Rogers) will change it back to the proper data.

Wikipedia isn't exhaustive, but I trust its accuracy (at least to a certain extent) on matters that Geeks and/or scientists consider important. I expect its explanations of math, science, and computer tech to be a LOT more exhaustive and pedantically-complete than most articles you'd find in Encarta or Brittanica.

For example: Public key cryptography. http://en.wikipedia.org/wiki/Public-key_cryptograp hy

This has a LOT of info, mostly correct (probably more correct than *I* would be able to be). The only place where I have read a better explanation is in the "Big Red Book" of Cryptography, Bruce Schneier's [b]Applied Cryptography[/b] (an excellent read). I suspect that any entry in Britannica or Encarta or whatever other "major", "respected" encyclopedia will have far less information, and be less useful as a learning aid.

For my money and time, Wikipedia is an invaluable tool. Don't discount it just because anyone can edit it.

Hell,

[Pope]

I'm even happier that you don't write VIRUSES!

More than AIM users affected

[elwin_windleaf]

My issue with that statement lies with families and shared computers; if Little Billy downloads AIM on the family computer, or a fellow student installs AIM to chat with his/her girlfriend/boyfriend, then I still could get hit with that virus on my family computer/campus PC.

Re:Designed not to be detected - as compared to...

[LurkerXXX]

Sorry, I do have a Ph.D. And I don't have time to keep going back all the time to correct something some 12 year old has messed up. I have real work to do. Some of the entries are decent. Others are not. I'm a scientist, and I can tell you I don't trust it's accuracy on matters I consider important. It might be decent at computer-sci entries, but there is a lot more to science than that. Rather than wonder, I'll reference a real source or respected encyclopedia.

Re:Designed not to be detected - as compared to...

[gknoy]

You bring up good points.

However, just because *you* do not have time, does not mean that someone else might not have. Since all articles are entered by volunteers, chances are someone cares enough about the subject. Most of the time, these peopel care enough about the subject not to spout drivel. Often they link to more authoritative sources, or to where the information was compiled from.

I'm certainly not saying that one should cite Wikipedia as gospel, nor that it is always the best source of information. It's not going to give you the same level of detail as someone's dissertation on the Hall Effect, and probably not on anything else either.

However, in the case that the GP referenced (the Wikipedia definition of a rootkit), it's a very GOOD first-pass definition. Not exhaustive, but certainly better than I would expect to find in Britannica or the dictionary. (A quick search of Britannica's online encyclopedia shows *NO* reference for a root kit. Or rootkit.)

Wikipedia's not going to be the best definition, but as a "What the hell is this?" resource, it's a GREAT tool for finding out basics on subjects. Or, as basic as the general public is going to care or understand about.

Just for the record, what subjects do you consider important, which Wikipedia has been lacking in? What are you comparing it to?

As an example of my basis of comparison:

Britannica: http://www.britannica.com/eb/article-9038924?query =hall%20effect&ct= (~375 words)

Wikipedia: (More, with pictures.)

Neither of these goes into as much detail as current research has (for example, no mention that I noticed of electronic propulsion via Hall Effect Thrusters). However, the Wiki article appeared to have generally more information, with room for growth. If someone wanted to know, "What's the Hall effect?", and did not have ready access (or time) to read the latest research papers and background material, it's a good start.

Re:Designed not to be detected - as compared to...

[gknoy]

Doh -- forgot to paste the wikipedia link for Hall Effect:

http://en.wikipedia.org/wiki/Hall_Effect

That won't stop anything

[Tim U.]

This is a very effective measure to help stop this type of attack.

Not if they use a serverside script or .htaccess to redirect to an executable.

This thing sucks

[Magnj]

I got this on my mom's computer, was a bitch to un install and still having issues

I don't know about you guys...

[catdevnull]

I don't know about you guys, but I'm going to walk without rhythm so I don't attract the worm...

(ducks)

So is it a virus or a worm?

[ShieldW0lf]

The article says it is a worm, but it describes the propagation of a virus. In which respect is the journalist wrong? After reading the article, I would initially be inclined to dismiss the use of the term "worm" as being used sensationally, but the article gives details about the researchers "honeypot" machine being infected, which would lead one to think it happened without human interaction. Then it proceeds to talk about IM virus transmission vectors in a generic sense, but never actually indicates that it's talking about this one in particular. So... um, does anyone know how the thing actually propagates?

Oh, and if you're reading this Joris Evers, you might want to give your editor shit. That article was terrible, and (s)he should have told you.

*and those of us...

[circusboy]

Who will quietly remind you that Tedy spells his name with one 'd.' ;)

Pedantry

[HydroPhonic]

Now, let me pedanticly correct you. I.e. does indeed stand for 'id est,' but 'id est' does not mean 'that is.' 'id est' is latin for 'it is.'

I'm surprised that you didn't fix "exempli gratia = for example" while you were in there.

CRAP

[Anonymous Coward]

alright, so if someone has a little icon on, say, xanga, that has their aim name on it, and I click that and IM them, I've got the worm? Am I completely misunderstanding? If someone could explain this in layman's terms to me in an email, please send it to raz_taz_bedazzled@yahoo.com because I'm scared crapless that my computer is screwed over.