Worm With Rootkit Package Loose On AIM

Mr0624 writes "According to a recent article on C|Net a new worm is swiftly spreading via AIM to many computers. It delivers a brutal root-kit which bypasses security software and takes control of a PC." From the article: "The worm was spotted in an AOL IM chatroom and infected one of the PCs that FaceTime uses for worm bait. The company said it also has seen the pest hit other computers. 'It is still out there, and it is definitely something the user should be leery of ... The rootkit is designed to not be detected, and that is the scary part.'"

Comments

Only Chat room users affected?

[BoldAndBusted]

So, I use GAIM, and I never use the Chat rooms. Should I worry?

Re:Only Chat room users affected?

[jZnat]

And I use Linux, so I'm assuming there's no need to worry. WINE isn't stable enough to support a virus/worm/trojan/etc.

Re:Only Chat room users affected?

[AnamanFan]

Assuming you're on a Windows operating system.

Use of GAIM will only prevent propagation of this worm. There are more levels at play here.

The worm is actually installed from a link you would click on from an infected IM. Nothing fancy here, it's just a simple HTML link. Clicking on this link will call up your web browser. What happens here depends on both the browser, patches, browser settings, and you. In IE, it's likely that the executable will just run it. Or, ask you to download/run said file. The latter true for Firefox or Opera as well as IE.

In any case, if your computer runs this executable, the computer in infected and it's game over. BUT, you won't be spreading the worm to others since you're using GAIM. The spreading of the worm depends on the AIM (or AOL?) client running on the computer.

That is until the worm writers also write for GAIM.

Re:Only Chat room users affected?

[EnronHaliburton2004]

Come on over to the IRC chatrooms. We're friendly, and we'll help you to activate some "worm-like" programs on your system. You don't want to miss out now, do you?

Re:Only Chat room users affected?

[Bastian227]

In any case, if your computer runs this executable, the computer in infected and it's game over.

As long as the thing isn't granted admin access, I don't think it's much of a threat (based on the article's description of the worm). It may still try to spread, but the clean up would be relatively easy.

Re:Only Chat room users affected?

[Fordiman]

Hmmm... Probably not. However, I would suggest not downloading and running any exe files from unknown sources. Unlike the idiots usin AIM who've been hit with this.

But you know what? I'm not going to be frightened by a worm or virus until someone writes one that works via bittorrent.

IE: The worm is a compact, surreptitious BT/Kademlia client. There are distributions of the nasty part built for Win32, OSX, and Linux, floating on the torrentstream. The nasty part can be any size, and has constantly updated exploit code for numerous pluggable targets (for example, you, as the virus writer, could add a torrented executable for exploiting a new bug in filezilla server, or in Apache, etc.) The virus core would download this and run it on the local machine. It could even be "smart", and detect the target machine's servers before getting and running the exploit. Once the exploit is run at the target machine, it uploads the BT client virus core for the appropriate architecture, and the process starts again.

One could use the usual tools for preventing detection and removal: polymorphic code, torrential code (code that is split on function barriers and resorted in random order on a per-spread basis), multiple copies, Knowing your Permissions (IE: run itself as user X, make user X root/admin, set permissions so that only user X can know the executable and process exist.) Persistent regression (IE: making sure that the executable is in the startup files of the OS) Trojaning, masking (encoding the executable and running itself via a decoder program) ...

Y'all should be happy I don't write virii. I've been fighting with them so long, I think I'd be pretty good at it...

Re:Only Chat room users affected?

[Schemat1c]

'Yes, firefox is indeed greater than women. Can women block pops up for you? No. Can Firefox show you naked women? Yes.'

Sure a woman can block pop ups, all she has to do is giggle.

Re:Only Chat room users affected?

[thesnarky1]

Yes.... your friends who don't can still send you the link. If you click it, boom. I've cleaned this off of 5 systems this moonth among my friends, Two GAIM, and 3 AIM. Its a nasty virus, I might add, and I don't think the article does it justice. Yes, it prerys upon P2P, but the worst part is, most users will click that link before thinking, so its free bait. This is social engineering at its worst, and the only way to stop it is to tell your friends and family right now. No, this is not a chain letter, this is a plea for help, I can only reach so many people on my own. For instance, my away message on AIM right now deals with this article, and the virus.
To answer the parent's question, as long as X person out there has this virus, you are affected, because they can send you the link.

Re:Only Chat room users affected?

[Gojira Shipi-Taro]

Do YOU know an average windows user that doesn't regularly run with account with Admin priveledge? I sure don't, because most applications publishers in the windows world make it more than slightly inconvenient to run with other than Admin level privledges.

So yea it's likely to be granted Admin access, and it's likely to be a threat, on the scal of the whole "nasty shit that causes unnecessary network traffic" thing.

Re:Only Chat room users affected?

[earthbound kid]

Back in the days of CRTs, I was always waiting for someone to write a virus that sets your refresh rate so high that your monitor catches fire. That would have been a cool virus. It's probably too late for it now though.

Re:Only Chat room users affected?

[glitch0]

They're COM files - the worm has been going around my town for about a week and a half.

It's usually a link with something like "HEY CHECK OUT THIS PICTURE OF ME - LOLZ!! http://shittywebpage.com/funny.com"

Since most people don't know that an COM file is executable they download and run it.

Unlike the idiots usin AIM who've been hit with this.
Yes, since everyone who doesn't know everything about a file extension not really in common use for many years is an idiot. Plus Windows hides extensions by default, which really doesn't help the problem.

Re:Only Chat room users affected?

[Aenema]

Yes. Even though its likely GAIM won't spread it, you'll still to get some spyware.
Incase you haven't seen any instances where someone is infected the messages are usually similar to

Wow! (http://genericwebhosting.com/XxXILikeSpreadingTro jans/cool.com)
or
Check this out! (http://genericblog.com/picture01.exe)

which can only be so obvious, but, then again, the mainstream instant messaging crowds are full of dumbasses.

Re:Only Chat room users affected?

[jacksonj04]

It's probably easier and cheaper to buy a whole new motherboard than just replace the BIOS.

Re:Only Chat room users affected?

[StormReaver]

"Sure a woman can block pop ups, all she has to do is giggle."

Isn't that the cause of most popups?

Re:Only Chat room users affected?

[Anonymous Coward]

First, cryptographically sign each piece of the payload. Have the worm verify each piece before running it, so your installed base isn't hijacked by others.

Second, use TCPA hardware if it's available, to truly take control out of the user's hands.

Third, explain all this in a little EULA that pops up when the luser clicks the link. Bury it in the middle where nobody will read it. If you do it right, you might be able to sue people for removing your worm or writing software that does so. :)

Fourth, call it Trusted Computing.

Re:Only Chat room users affected?

[hoggoth]

> there was a virus making the hard disk heads slam against the casing of the drive

Even better (worse), on my old Apple II+ I got a virus that slammed the hard disk head against the casing in a carefully timed pattern to play CHRISTMAS MUSIC from the humming and shaking of my hard drive case!

There's nothing weirder than hearing 'Santa Claus is Coming to Town' coming from your computer and realizing it's not coming from the computer, but from your hard drive which is slowly vibrating it's way off the edge of your desk.

Re:Only Chat room users affected?

[TVmisGuided]

'Sure a woman can block pop ups, all she has to do is giggle.'

Giggling, by itself, won't block popups. Giggling in conjunction with pointing, however...

duh

[Anonymous Coward]

"'The rootkit is designed to not be detected, and that is the scary part.'"

ummm isn't that the definition of a root-kit?

Re:duh

[killa62]

Actually, rootkits go out of their way to be undetected.
(Shamelessly stolen from grc.com)
"What happens is, they essentially modify the way the OS itself works. They're compromising the operating system kernel. You know, in operating system terminology we have the notion of a kernel, which is the OS core. And then you've got applications which run as sort of clients of that operating system. So a program you're running, you know, Corel Draw or Outlook or whatever, that's a client of the operating system. Well, so are the spyware scanners. So when you're running even a spyware scanner, it's saying to the operating system - in fact, for example, there are two API calls that's "find first file" and "find next file." So if you ever want to, like, do a directory listing, you'll say "find first file *.*," and it gives you the first file. And then you successively call "find next," "find next," "find next," until it returns no more files. That's all there is to it. So that's - so anything that's scanning your system is basically doing that.

Well, imagine if something altered the way the "find first" and "find next" operated, so that it was intercepting the response back to you, out of the operating system, back to any application that was asking, so that if it was about to report one of its own files, it would call - it would say, whoops, and call "find next" again on your behalf, skipping over that file. Suddenly any program running on the operating system will not see any of those stealthed, rootkitted files. They just disappear. "

link
http://www.grc.com/sn/SN-009.htm

Re:duh

[Billly Gates]

Try explaining that to grandma? After all her antivirus software said nothing was installed right?

Explaining about api's only makes you look incompentant if your an It professional because your not speaking down to their language to build confidence.

I had a rootkit last month. Nothing could get rid of it but a full fdisk/mbr where I lost everything. It was MBR based and would append itself when running windows which made it nearly impossible to delete.

Watch as spyware makers do this in the future to prevent anyone from deleting their wares.

Re:duh

[Kiaser Zohsay]

IIRC, the name "rootkit" came from the fact that you had to get root access to be able to install it. The rootkit itself was used to conceal the fact that the system was compromised, but the compromise had to happen first.

http://www.catb.org/~esr/jargon/html/R/rootkit.htm l

Apparently "rootkit" will be the next malware term to be misused after crossing over to the Windows world.

Who of us actually would click...

[rkitchen]

"Check out these great new pics of us!! LoLz :)"

Re:Who of us actually would click...

[Nuskrad]

Probably very few of *us*, if you're referring to Slashdot readers, who we shall assume have some degree of computer literacy. However, the vast majority of internet users are idiots. Simple fact.

Re:Who of us actually would click...

[karvind]

:(

You cheated, there was no link in your post. I have been clicking on the post for last 10 min, nothing happened.

Re:Who of us actually would click...

[kakashiryo]

You want to know scary? My mother asked me where the Desktop was.

Re:Who of us actually would click...

[macsox]

i don't know why i'm engaging on this, but i will.

the vast majority of internet users are not idiots -- they are merely undereducated about computers and the internet.

my nice response to your comment is that you should try to appreciate that not everyone has the time, energy or will to learn computers to the extent that you or i have.

my mean response is as follows: i have a theory. kids start out life talking about how they want to be astronauts, or the president, or teddy bruschi.* they see a vast world of limitless possibility and imagine themselves filling up an enormous space within it. as people age, they start to realize that they most likely won't be a michael jordan or a bill gates, and their response is not to be content being a small fish in a big pond -- it's to reduce the size of the pond that is 'important'. so, i, for example, work in politics. it's easy for me to see the political world i inhabit as the most important thing locally, or even in the world, and to feel very self-important as a result. many users on slashdot see the world of tech as the pond. or their own i.t. departments. people reduce the scope of the important world, until they are a big fish. i call this, uncleverly, 'resizing the pond'.

i posit that you are resizing the pond. and, further, that you shouldn't.

</self-righteousness>

* don't know who this is? there are people who would call you an idiot if you didn't.

Re:Who of us actually would click...

[geminidomino]

the vast majority of internet users are not idiots -- they are merely undereducated about computers and the internet.


"Hey, you don't know me, but I just KNOW you'll love what I have in this box. Go ahead, take it home and open it."

Trusting complete strangers isn't a mark of techno-ignorance, it's a mark of idiocy.

Re:Who of us actually would click...

[macsox]

first of all, you seem to think that going to best buy is the same as buying things from people in alleys. which i have to say is a bit simplistic.

second, trusting complete strangers is a mark of being able to function in society. when you leave the house, do you need to ensure that everyone driving down the street is a friend or acquaintance? when you go to a restaurant, do you get background checks on the staff? from whom did you buy the aluminum foil to make your hat? mom?

Re:Who of us actually would click...

[Toasty981]

"Hey, you don't know me, but I just KNOW you'll love what I have in this box. Go ahead, take it home and open it."

Trusting complete strangers isn't a mark of techno-ignorance, it's a mark of idiocy.

I think part of the problem--and nothing earth-shattering here--is that people still think of PCs as a regular appliance. I know people who think of websites the same way they would think of turning on a TV show. If a friend tells you to turn on a station, nothing bad could happen to the TV. They tend to think the same of a website.

Now, the question is whether people who get infected learn their lesson...that's what I'd like to see. Anyone know of any studies or such related to that? Do people take security more seriously once it happens? You'd think so, but we all know people who went back to using IE after we install Firefox/Opera/other because the Flash games wouldn't work.

Re:Who of us actually would click...

[herriojr]

You're not taking into consideration that it's a message from someone on your buddy list, not a perfect stranger.

Re:Who of us actually would click...

[jlarocco]

the vast majority of internet users are not idiots -- they are merely undereducated about computers and the internet.

my nice response to your comment is that you should try to appreciate that not everyone has the time, energy or will to learn computers to the extent that you or i have.

Maybe the vast majority of internet users should take the little bit of time to appropriately learn about computers and the internet. I'm not saying everyone who uses a computer should be system admins, but I don't think it's too much to ask that people who are going to use a computer every day have at least a basic understanding of what they're doing.

If someone were to get behind the wheel of a car and start driving, with no drivers license, having never driven before, they'd go to jail. It's the law that people have to have at least a basic knowledge about their car and how to drive. Yet, at the same time, any moron with $400 can bring home a new computer, hop on the interweb, and have their new computer pwned and DDOSing some random website in 2 minutes because they either don't understand or don't care to follow simple advice like "Use a virus checker and firewall". Obviously, computer and internet use shouldn't be regulated as heavily as driving, but if people can't be bothered to take a little time to learn how to use their computers, they deserve everything they get in my opinion.

Re:Who of us actually would click...

[Toasty981]

Good point. If people never know it's there, they won't learn from their mistakes.

Come to think of it, I do know a few people who do just what you said...reinstall their OS when things go wrong. Maybe in the long-long term, people will make an association between certain activities and having to reinstall.

Re:Who of us actually would click...

[joranbelar]

Trusting complete strangers isn't a mark of techno-ignorance, it's a mark of idiocy.

What strangers? The links come from people that have you on their buddy list.

Re:Who of us actually would click...

[Deathanatos]

Who of us actually would click... "Check out these great new pics of us!! LoLz :)"

The sad thing is, people do! And not only do they click the link pointing at some odd site, they download a file, and execute it!

There was an AIM trojan similar (but not the same, I believe) that got circulated to me (by a few of my 'friends') this last week. It's text was something like, "check out these kewl pics of me!" Now, if anyone I know said "kewl" that'd instantly throw red flags. (And still, I got that same IM _6_ times that one night.) So, I take a look. The link points at some odd site, with a .php file. Now, none of the people who IM'd me that night were smart enough to set up a websever w/ PHP. The PHP file, I find, hands you a .com file (With the oh so cliché name img552.com). (Which I think was actually a full Win32 app...) At any rate, through some research, it seems you needed run it in a root user account.

And that's just the thing. Many of these AIM virus/trojan/etc. need not just one, but several lapses of logic to work. They still manage to spread, however. When you click a link, download a virus, and then run it in a root account (although half the world runs as root...)... that's three (usually) fairly obvious lapses in your thinking.

This isn't a hole in the computer, it's the user. Users are..., uneducated. Many /.ers know this, people don't understand how the technology they live with works. Until they do, things like this will continue to work, and people who fix computers will continue to make a living, and we'll keep having to listen to journalism repeat the same words: Don't open executables you don't recognize. (Then again, don't these stupid Windows computers hide extentions by default? We keep telling users not to open things that end in .com, .exe, etc., but all they see is cool_pic(.com!))

But this is /., and I'm preaching to the choir.

Re:Who of us actually would click...

[moltar77]

"Two things are infinite: the universe and human stupidity; and I'm not sure about the the universe."
-Albert Einstein

Re:Who of us actually would click...

[glesga_kiss]

And for the person who is no doubt going to ask "Well how do you know you don't have a virus if you have no virus scanning software?". Simple. If I had a virus it would have to be one that:

- Did not affect the running of my computer negatively.

- Did not create any network traffic.

- Did not attempt to infect files.

So, if I had a virus that met all of those criteria, I don't think I'd have to worry about catching it.

How did you know that it didn't dial home? You said you had no security and no anti-virus, and that you were running natd/ipfw. Perhaps if you were also running some intrusion detection software on the firewall, or had an application-level firewall, you might actually be able to say "did not create any network traffic"? What were doing to make this assertion? Watching the blinkenlights on the hub?

The perfect virus (nowadays) does the following:

• Infects silently
• Rarely dials home, and when it does it's piggybacked on another, non-suspicious protocol. E.g. "firefox http://mydodgysite?id=yourUniqueId&data=fillInHere
• Does not inpact the day-to-day running of the PC
• Patches the original vunerability to:
  • prevent other viruses stealing away the rooted box
  • prevent other viruses from impacting the operation of the PC (meaning it gets fixed or reinstalled)

Don't have any programs, I MEAN ANY, which automatically run any sort of executable. That's just asking for it.

You truely are an idiot. ALL programs can do this. It's a basic part of how programs work, they make calls to other programs! The question is, can they be made to run malware through either bad design or exploit (e.g. buffer overflow). There is NOTHING you can do against the latter. Even the infalible Firefox is currently on v1.07 because of EXPLOITS in older versions.

The only system I can think of that can stop apps running system commands is Java. You don't seem like the Java type somehow though.

"Don't use your firewall to do your job for you. Shut off the services you don't need."

That's IN ADDITION to a firewall. NEVER rely on software on your PC to sort out what you have open. A virus can easilly (silently) restart a service, and you'd NEVER know. Likewise with "personal firewalls". The firewall should be a different box with different accounts. If you are truely paranoid, never enter it's password on a potentially hacked machine and stick to console access only.

I hope you are running security for anything important...

*yawn*

[patio11]

Summary of TFA: "You might have seen this trick before. A friend points you to a link to an .exe file. You click on it and, ignoring the security message which pops up, attempt to run it. Bad stuff happens. BUT WAIT! Now bad stuff includes a 'root kit', too! Doesn't that sound scary and hacker-y?"

Designed not to be detected - as compared to...?

[Telcontar]

"The rootkit is designed to not be detected, and that is the scary part."

You can often judge the quality of the articles linked to by /. by their summaries. Check the definition of root kit before writing such a summary. One would hope that at least story submitters are more competent than the average journalist - but then again, this is /. :-)

Um...

[Anonymous Coward]

The rootkit is designed to not be detected

So ... most rootkits are designed to be detected?

Noteworthy tools

[nmb3000]

I suppose that anyone in the computer tech/repair shop industry might appreciate tools like Rootkit Revealer right now.

Hopefully Microsoft's project that hasn't been released yet will show up soon. They also have a few hints to detect rootkits installed on a system including two Slashdot links.

Hooray for AOL.

Re:Noteworthy tools

[chris_eineke]

I suppose that anyone in the computer tech/repair shop industry might appreciate tools like Rootkit Revealer right now.

I 'spose that anyone in the computer tech/repair shop industry appreciates worms like these.

Old..

[Chickenofbristol55]

This is actually pretty old news, one of my friends got this a few weeks ago (he's not a geek, and he called me because I build this custom pc for him). It's quite easy to fix though, a good Ol' system restore fixes it, and there are many programs that can search for, and delete rootkit and other trojans (i'm talking about other programs besides antivirus programs, which sometimes have a hard time deleting these buggers). The trojan was called directX.exe, found in windows/system32 folder. My suggestion: don't click on a link from a friend before 1) you know what it is 2) and make sure that it doesn't say that your downloading a video file, when it's obviously a batch or exe file. This virus is not really a big deal, you just have to have half a brain to deal with it.

Re:Old..

[mr_z_beeblebrox]

My suggestion: don't click on a link from a friend before 1) you know what it is 2) and make sure that it doesn't say that your downloading a video file, when it's obviously a batch or exe file. This virus is not really a big deal, you just have to have half a brain to deal with it.

Is this a duplicated post. I am sure I read this in 1995 ;-}

Re:Old..

[Anonymous Coward]

It's quite easy to fix though, a good Ol' system restore fixes it, and there are many programs that can search for, and delete rootkit and other trojans (i'm talking about other programs besides antivirus programs, which sometimes have a hard time deleting these buggers).

Rule #1 when dealing with rootkits (or other break-ins)... The system can no longer be trusted. That means any and all executables on the system are suspect (including System Restore functionality) and may have been tampered with.

On a unix/linux box, that means shutting the system down and booting from read-only media that cannot be tampered with. Then you use tools that are only on the CD/DVD to investigate the system and find out what files have been changed / corrupted / hijacked. This is where tools like Tripwire come into play (or simply using fingerprinting tools like md5sum and doing a diff between two sets of signature files).

On a Windows box, you're better off with a format and re-install from CDs. Or, if you thought ahead and created a disk image using Knoppix, you could restore using that image. (Be sure that it's an image that you know is clean.)

Luckily for you, it sounds like the worm that you dealt with was apparently not very sophisticated. But how can you be sure that you've removed that rootkit from the system? And who's to say that the next one won't interfere with System Restore?

Never assume that worm writers are stupid. Don't assume you can outsmart them. However, most of the time (unless you are a specific target), worm writers are looking for the biggest return for least effort. So a worm that infects the majority of hosts is enough and they will not bother writing the code to infect the rest.

IOW, if System Restore functionality begins to have a significant impact on infection rates, you should plan on System Restore functionality being broken by future worms.

In summary:

- Backup your data files regularly.
- Boot a Knoppix CD/DVD and fingerprint your system regularly for a baseline to compare against at a future date.
- Use that Knoppix CD/DVD to create snapshot images of your currently working (and uninfected) system.
- If you're infected / invaded, assume that you haven't found everything and will need to rebuild the system from scratch.

(Yes, I've fought off a rootkit once. It was a real pain.)

When everyone runs as root already

[Andrew Tanenbaum]

or "Administrator", rootkit designers don't even need to escalate privelages. I can't wait for Vista :|

Re:When everyone runs as root already

[Mantus]

Due to poor software design, it's difficult to not run ad admin. Most programs run no problem, be some, like WinAMP, need to have their directory permissions changed to run and a non-admin. While this isn't a problem for power users, most users won't even know how to change the permissions (in XP Home you need to boot into safe mode to get the security tab to appear in the file properties windows)

Despite the fact that the \Documents and Settings\username folder exists, some developers choose not to use it, and that causes problems.

Re:AIM client, or AIM protocol?

[antifoidulus]

Considering the rootkit is spread by users clicking links and has NOTHING at all to do with the protocol, I'd have to go ahead and have to say yeah, it can spread via any client that lets you click on links and I'd also have to say RTFA

Root kits

[Rufus211]

"The rootkit is designed to not be detected, and that is the scary part."

As opposed to those root kits that are designed *to* be detected? Damn it, thinking again instead of being scared into buying something. Really need to work on that...

Re:hah

[saskboy]

Frequently Messenger type programs get worms that do NOT require the user to click, thus making the virus that much more worm-like since it doesn't require user intervention. Windows XP had several of these vulnerabilities, and so did MSN Messenger 6. Did you ever wonder why Microsoft forced upgrades sometimes? It's because a critical bug was found in their JPG processing code for instance, and the mere presence of MSN 6 and an infected buddy messaging you automatically, because they got infected automatically, meant you got infected too. It came through a malformed .jpg or .png Avatar picture that on most Messengers is set to download and display upon arrival of any message from that person, even a message sent by a virus.

As compared to the one with the alert box?

[Saeed al-Sahaf]

How about a root-kit with a pop-up: "Do you want to install this Root Kit? Yes / No"

I'll bet that there are a lot of people that would just click on through for what ever the carrot is, screen savers, free porn, or whatever...

Re:As compared to the one with the alert box?

[Entropius]

This's work especially well in Australia, when the root-kit *could* be the carrot...

Wow...

[megabyte405]

Not sure how you have a rootkit on a system (Windows) that doesn't have a "root" user per se... Presumably it's so called because it gets admin privs, but they aren't needed for much on Windows. It's not even that tough to remove, and I've seen it starting a few weeks ago. Much ado about nothing on C|Net is what this looks like - AIM worms aren't anything new, especially not when you work with college students.

Re:Wow...

[oPless]

Actually it's much worse.

Administrator privs on windows is pretty much "root" as far as users are concerned *but* there is a higher level of privs. The SYSTEM user, which has a complete control (iirc, and I might not cos it's 4:30am here) it's near enough acting like the operating system as makes no difference.

rootkits tend to get themselves to SYSTEM privs :o(

malware social engineering

[G4from128k]

TFA suggests that this worm (technically a trojan) spoofs a buddy -- making the worm-loading link seem innocent. The advice is to always confirm that your buddy sent you something. I leave aside the reality that most people aren't going to pester their friends with a "Did you just send me something" messages. It may be good advice, but most people probably feel like paranoid lusers asking every time a buddy sends a link.

The bigger point is that malware need only become better at social engineering to convince most people not to ask. If the worm sent two messages -- one with the link and a second one with a friendly confirmation ("Hope you liked that link. See you later."). This could easily convince many people that it was a trusted link from a trusted source. By the time they actually talk to the friend (if they do) and mention it, the friend will deny sending anything, the infected person will check their PC, find no evidence of an infection and just be puzzled by the exchange. But it will be too late.

Yes, some people might still ask or be suspicious. But infectious malware needs only to succeed with a very small % to create a very large and valuable botnet.

Well...

[slavemowgli]

It delivers a brutal root-kit [...]

As opposed to the usual kind and gentle root kits, I suppose?

The rootkit is designed to not be detected, and that is the scary part.

Isn't that part of what makes a root kit?

Ad Nauseam

[Secret Rabbit]

"This is the first time that we have seen a rootkit as part of the bundle of applications that is sent to your machine. It is a disturbing trend."

One worm does not a trend make.

"The rootkit is designed to not be detected, and that is the scary part."

Isn't this the actual point of any worm/virus/etc. To not be detected so as to be able to do what it's supposed to do. Haven't these things been doing this even before the 90's... really since the beginning.

This is just more typically stuff. User gets something that looks like it came from someone they know and they click on the link like the dumbass user that they are. This despite the fact that they are *always* told to never just click.

They'll never learn and as such, things like this will continue to happen. Stuff like this became not news to me a *long* time ago.

All I have to say is, ad nauseam.

How to remove it. The answer.

[TheGSRGuy]

http://www.jayloden.com/VirusClean.htm

This tool is updated almost daily. 100% effective, I can vouch for it. You can become infected if you click the link on non-AIM clients, but it won't spread to everyone else on your buddylist.

Re:How to remove it. The answer.

[rhizome]

I can vouch for it.

And who are you?

Re:How to remove it. The answer.

[Atragon]

And who are you?

He's TheGSRGuy of course.

Re:Why aren't they prosecuted?

[Jeng]

Honestly that has bugged me the most about not only trojans like this, but spam in general. Why go after the distributer, go after the source. There'll always be another spammer or script kiddie up for takeing the last guys place.

Make it unprofitable for businesses to use these tactics and the tactics will go away, or at least be less prevelent.

Just curious

[max born]

"A very nasty bundle is downloaded to your machine" when you click on the worm link ...

Why with anyone write a chat program where you can install (and obviously run) a program just by clicking on a link?

Besides that, in Windows isn't there a way to run programs (like chat) as an innocuous (nobody) user limited only to that user's home directory and with limited write capabilities?

What gives?

Yahoo.com and Google.com

[tepples]

How many people still use .com files anyway?

Yahoo.com, Google.com, Fark.com, News.com.com... Windows stores Internet shortcuts in files with the .url suffix, but even when you have "hide file extensions" turned off, Windows still hides the .url suffix, making it nearly impossible to distinguish Google.com from Google.com.url in icon view and difficult in any other view. The little arrow in the corner doesn't mean much, as the Google.com file could contain an icon with the arrow already drawn inside.

Re:Yahoo.com and Google.com

[wx327]

You can change these settings in explorer by going to (using the URL internet shortcut as an example):
Tools/Folder Options/File Types/URL/Advanced/Always show extension

Alternatively, you can edit the registry and create the following key:
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\InternetShort cut] (slashcode will probably insert a space somewhere in there)
"AlwaysShowExt"=""

Re:Why aren't they prosecuted?

[generic-man]

180solutions is not a perpetrator and you can't implicate them in this scheme. If someone spray-painted "HAHA I RULE, SINCERELY, JOE SMITH 212-555-5555" on your house would you immediately call the cops asking that they arrest Joe Smith? Let's not forget what Joe Jobs are.

Now 180solutions could invoke the terms of their affiliate agreement and freeze payments to the scumbags that install this software on the sly. Of course that's no consolation to the consumer that gets stuck with that adware/spyware on his machine.

Forcibly installing 180solutions' software is no different legally than forcibly installing Firefox the next time someone visits your website with an unpatched version of IE. Both are immoral and should be illegal, but the software authors can't be faulted for producing software that may be installed without the user's consent by way of an IE vulnerability.

Re:AIM client, or AIM protocol?

[Kadin2048]

Well this is true, it could just as easily be spread via email or something, but the relation to AIM is that once the virus (trojan, whatever you want to call it) gets into your system, I believe that it sends out messages to all of your contacts with the link, propagating itself.

At least this is how several other IM viruses have been spread. I noticed that just this weekend I got several IMs from people that I haven't talked to in years (but who apparently still have me on their lists) which were nothing but links to .COM or .EXE files.

One of them was being hosted at this address:
http://home.earthlink.net/~two4tea/mc-110-12-00000 80.exe (It has since been removed -- the link is dead)

And I didn't get the other URL that was going around. I downloaded the file and opened it up in a hex editor just out of curiosity (I'm on a Mac so it wasn't possible to execute anyway), but there didn't seem to be any obvious text strings or anything.

What I wonder is how the file got up on that web site to begin with; it seems rather farfetched to believe that a virus could find out that someone has a Earthlink web page and upload itself, then send out that link, which makes me think that the person spreading the virus probably planted it there after somehow gaining access to the account, and then letting the version of the virus which points to that URL out. When the linked file is removed the virus stops propagating, but by then has already spread and nabbed a few unwary users. Unless the program has the capability of 'phoning home' to get the URL of the latest location to send out to everyone, that is. The file was a few hundred KB, so I suppose it's entirely possible that it has that capability; you could fit quite a bit of code into something like that.

Not really my area of expertise, but perhaps someone who knows something more can elaborate on how these things work?

'Rootkit' detection

[dedazo]

OK, I have a beef with this beign called a 'rootkit'; it's really a trojan that can hide itself very well. But anyway. SysInternals has a sort-of 'rootkit' detector called Autoruns that looks at everything that is loaded on to kernel and userspace at boot time. It's extremely useful because it provides an abridged view of what your PC is running when it starts. This is not a 'clik here' end user tool - you have to know what you're looking for. But I used it a few months ago to get rid of a nasty worm on a friend's machine. Might also want to get ProcessExplorer to actually get the cleanup done.

Or... just tell people not to download crap from 'teh interweb'.

Spyware Included

[diagonalfish]

The worm also places several spyware and adware applications, including 180Solutions, Zango, the Freepod Toolbar, MaxSearch, Media Gateway and SearchMiracle, the company added.

So, would you like some spyware with your virus at no extra charge? I know this is fairly common, but does this imply that the people that make the viruses are the same ones that make the spyware we have grown to know and love? It seems that the line between "spyware" and "malware/viruses" gets more blurry every day.

Re:Spyware Included

[PinkFreud]

Actually, whomever released this particular worm is likely making money off the installed spyware via a referral-type scheme.

That's how it's usually done with malware nowadays - the authors of spyware typically don't care who is installing their crap on peoples' computers or how they're doing it. A worm author (or just someone releasing it) can sign up for an account with these spyware companies, and simply make sure the account is referenced when the spyware is installed on an unsupecting victim's machine.

It definitely makes one possible route to trace these scumbags.

Hey kid, want some candy?

[Kadin2048]

Actually it's more like the old adage about taking candy from strangers. "Here, eat this! You'll like it!"

Most people just don't make the mental connection that they could click on a link -- something they do pretty often and usually without incident -- and cause serious harm to their computer.

I vote that it's more ignorance (to a certain degree self-imposed, because a lot of people could understand a lot more about their computers if they wanted to, but simply choose not to) than a lack of ability or mental capacity.

Re:Looks like...

[Barbarian]

It looks like the begin of the end. When enought people come to there senses they might start looking for alternative OS's!
 
  Oh, you mean alternative OSs like LINUX for which NO rootkits exist?

Re:duh... damn

[John Hasler]

> ...the ones that pop up the message "Would you like to download and
> install a rootkit".

I expect that would work fairly well.

Re:Example

[Red Alastor]

Yes, as long as you don't value what's in your home directory.

Idiots

[Azerious]

If you bother to upgrade to newer versions of windows, SP2 will ask you if you want to open or download the file, which is usually called something like http://12.234.426.43/picofme.jpg but it tells you this is an executable, so if you are still dumb enough to run it after it tells you "Hey! I'm an executable hiding as a jpeg", then you deserve to be infected and so do your friends.

Re:A couple of hours?

[mindstrm]

Right then, well, "System Restore" is a feature of Windows XP that snapshots the status of a whole bucketload of system settings, DLLS, etc... each time you update software, and at other times determined by the system, these snapshots are taken. You can go into system restore and revert to your system status from yesterday, last week, or just before oyu installed something, and it generally works very well (meaning quickly, reliably, and doesn't erase your data.) It doens't make a mess, either.

It was a very surprisingly well done feature, I can't actually believe it came from MS

Some viruses DO run on WINE

[killa62]

Some windows viruses do run under WINE. However, they do not affect the system to the extent that windows viruses affect windows systems. They RUN, but mostly nothing else happens other than wasting CPU cycles.

I think this was posted on /. before.
http://os.newsforge.com/article.pl?sid=05/01/25/14 30222&from=rss

Re:Some viruses DO run on WINE

[Psykosys]

When are they going to get around to full virus support? (I'm sticking with Windows 'til then.)

Re:Some viruses DO run on WINE

[cerberusss]

The article text was posted as a comment to that story.

Re:Designed not to be detected - as compared to...

[LurkerXXX]

So, before posting a ill-informed summary, they should check first as a reference a 'encyclopedia' that lets 12-year olds edit and delete stuff posted by Ph.D.'s working in the field?

And your hoping for competence???

Re:hah

[rm999]

In the case of AIM, I am pretty sure you have to click a link. And I stand by my opinion, regardless of what the moderators think :)

Re:Example

[The Cisco Kid]

Downloaded it. So now I have a file that appears to be meaningless binary gibberish. (AKA "Application/OCTET-STREAM") How does one 'run' such a file? I can't seem to find a Makefile, or any other way to compile it. I guess I don't quite get what is dangerous about it?

been here before

[jordan]

we warned them once , we warned them twice .

silly AOL, will they ever listen?

FDisk in 2005?

[Anonymous Coward]

I had a rootkit last month. Nothing could get rid of it but a full fdisk/mbr where I lost everything. It was MBR based and would append itself when running windows which made it nearly impossible to delete.

It's 2005 and you only tried FDisk? There's a number of free boot record editors that could have fixed anything. There is no rootkit that I know of that is based out of the MBR the way the old Pakistani virus did to Apples. If I have a customer who needs data recovered off a rootkit infected computer I put it in as a slave in a WXP or W2K system.

Re:FDisk in 2005?

[Anonymous Coward]

One of the rootkits out there puts autorun files in C:\.
If you plug it into a second W2K computer as a slave, it infects
that one. Hard-disk to hard-disk virus!

Re:FDisk in 2005?

[mstromb]

Which is one of the reasons why autorun is one of the most insecure things about windows. Yay for randomly running arbitrary commands from unknown sources!

Unfortunately, if you turn it off, anyone else using you computer becomes incredibly confused as to why windows "doesn't work".

Also, I've run fdisk /mbr on windows xp machines in the past (fixing botched dual boot attempts), and not had an issue. As far as I know, that command simply resets the MBR to the deafult value - that is, run ntoskern or whatever on block 0 of partition 0. More or less. Or is that completely wrong?

Re:FDisk in 2005?

[m50d]

Everything runs in circles. I remember the days when the main way you infected things was having another disk (hard or floppy) in while you booted.

Re:FDisk in 2005?

[clymere]

Using a clean windows machine to fix an infected windows drive isn't all that smart in the first place. This is an area where live disks excel, Knoppix being the obvious first choice...not to mention the many variants with more specialized tools added on. You're running a different OS, its running off of read-only media, and you're risking essentially nothing.

Why doesn't AIM block executable attachments?

[oasisbob]

When I was working on developing a Snort rule to detect links to .pif attachments in MSN messages, I was surprised to learn that Microsoft would quietly discard any messages which contained a link to suspicious executables. It even blocked links to fake .pif files I hosted myself, so it wasn't a URL blacklist.

Why won't AOL do the same with AIM? This is a very effective measure to help stop this type of attack. I work at the resnet for my university, and these types of worms are very annoying to help students deal with. Using Snort last year, I was able to see that over 1/3 of all students who received a particular "OMG click this link!" email clicked it, became infected, and started to spew messages to the infected file.

Blocking the messages before they even arrive is by far the most effective way to stop this infection vector. I'm hard-pressed to think of a reason why this is a bad idea.

There really is a *nix under the hood afterall

[ferretous]

I tried to login as root on my windoze box but it wouldn't let me. Does that mean I have already been infected (or should that read rooted)?

HA!

[tjlsmith]

*I* pressed the shiny red button and noth@#$@#$##)(*)()_(NO CARRIER

About the rootkit

[nightcrawler77]

This looks like the same worm a friend of mine got a few weeks ago. I loaded it up in VMWare and discovered that it installed, among other things, the "FU" rootkit.

I took a rootkit class at this year's Black Hat Training from the guy who wrote FU. He pointed out that it's more of a proof-of-concept rootkit. It does allow you to hide files, registry keys and drivers from both user-mode and kernel-mode processes, but, it really doesn't go out of its way to hide itself from every possible angle, so detection (and thankfully, removal) wasn't that bad.

I was able to whip up a little app to fix it from within Windows. But had the worm's author actually expanded on FU's techniques and done a better job of hiding the rootkit, recovery would not have been as nearly as easy. (Just imagine how much fun would it be to talk a novice through Windows XP's Recovery Console!)

Once the worm authors start to get better at exploiting the potential of rootkits, we've definitely got a much better problem on our hands. The old "1. get infected, 2. run anti-virus to disinfect, 3. repeat" cycle just won't work anymore. Good luck even finding a well-implemented rootkit once it's in your kernel, let alone trying to clean it up while it's effectively able to veto every action you take.

(Yet another reason why no Windows user should run as an Administrator.)

IE and i.e.

[stonedonkey]

IE: The worm is a compact, surreptitious BT/Kademlia client.

Took me a second to realize that "IE" meant "id est" and not Internet Explorer. And "id est" means "that is," not "for example," also known as e.g. (exempli gratia).

Handy cheat sheet:

i.e. = id est = that is (not commonly captitalized, or puncuated as an acronym like IE)

e.g. = exempli gratia = for example

There's your pendantic lesson of the day :p

Re:IE and i.e.

[PakProtector]

IE: The worm is a compact, surreptitious BT/Kademlia client.

Took me a second to realize that "IE" meant "id est" and not Internet Explorer. And "id est" means "that is," not "for example," also known as e.g. (exempli gratia).

Handy cheat sheet:

i.e. = id est = that is (not commonly captitalized, or puncuated as an acronym like IE)

e.g. = exempli gratia = for example

There's your pendantic lesson of the day :p

Now, let me pedanticly correct you. I.e. does indeed stand for 'id est,' but 'id est' does not mean 'that is.' 'id est' is latin for 'it is.' I know this, because I speak the bloody language. Thank you.

Re:IE and i.e.

[suwain_2]

This aren't "real" translations, but I find this to be easier to remember:

i.e. = "in effect" ("in other words")
e.g. = "example given"

Just think of it as a handy mnemonic device as opposed to literal translations.

Re:Looks like...

[Hosiah]

When enough people come to their senses they might start looking for alternative OS's!

That'll happen about the time stupid assholes quit recklessly dishing out mod points.

World of Warcraft

[Kagami001]

For anyone curious, WoW runs fine in a limited user account as long as that account has write privileges to the executable folder and files to allow updates. It also doesn't require any HKLM settings to run, so you don't need to even run the installer on your system, you just need the files it unpacks. (I used VMware to run the installer.)

I'm not sure games that require arbitrary patching of files on someone else's (Blizzard's) schedule are all that much easier to implement in any other OS, though. A separate copy of all the game files for each user would be prohibitively large, but giving all players write access to the executable directory allows any single user to bork the whole thing if they feel like it. (Not an issue if only one user has access to play that game, but.) The only other option with current security and file-system models is to have a privileged updater executable, and then you'd have to be trusting some updater application from Blizzard with root privs on a regular basis. Either that, or Blizzard would have to get its updates approved for addition to the distribution's package repository every time they wanted to update their game.

I'm already not a big fan of the way adding software to Linux and Windows systems requires full root privs as a matter of course. Most software only needs rights to write to one specified directory and add an entry to a list of installed software; why the heck should I have to give the installer full control of the system?

Personally...

[infinite9]

Personally, I like when they pop up like that.

And with firefox, you get to touch a mouse, but with a woman, you get to touch a cat. (meow)