Slashdot Mirror
Worm With Rootkit Package Loose On AIM
Mr0624 writes "According to a recent article on C|Net a new worm is swiftly spreading via AIM to many computers. It delivers a brutal root-kit which bypasses security software and takes control of a PC." From the article: "The worm was spotted in an AOL IM chatroom and infected one of the PCs that FaceTime uses for worm bait. The company said it also has seen the pest hit other computers. 'It is still out there, and it is definitely something the user should be leery of ... The rootkit is designed to not be detected, and that is the scary part.'"
So, I use GAIM, and I never use the Chat rooms. Should I worry?
"'The rootkit is designed to not be detected, and that is the scary part.'"
ummm isn't that the definition of a root-kit?
"Check out these great new pics of us!! LoLz :)"
"The rootkit is designed to not be detected, and that is the scary part."
/. by their summaries. Check the definition of root kit before writing such a summary. One would hope that at least story submitters are more competent than the average journalist - but then again, this is /. :-)
You can often judge the quality of the articles linked to by
The rootkit is designed to not be detected
... most rootkits are designed to be detected?
So
I suppose that anyone in the computer tech/repair shop industry might appreciate tools like Rootkit Revealer right now.
Hopefully Microsoft's project that hasn't been released yet will show up soon. They also have a few hints to detect rootkits installed on a system including two Slashdot links.
Hooray for AOL.
"What do you despise? By this are you truly known." --Princess Irulan, Manual of Muad'Dib
/)
This is actually pretty old news, one of my friends got this a few weeks ago (he's not a geek, and he called me because I build this custom pc for him). It's quite easy to fix though, a good Ol' system restore fixes it, and there are many programs that can search for, and delete rootkit and other trojans (i'm talking about other programs besides antivirus programs, which sometimes have a hard time deleting these buggers). The trojan was called directX.exe, found in windows/system32 folder. My suggestion: don't click on a link from a friend before 1) you know what it is 2) and make sure that it doesn't say that your downloading a video file, when it's obviously a batch or exe file. This virus is not really a big deal, you just have to have half a brain to deal with it.
public class null extends java applet { System.out.print ("Tabula Rasa"); }
"The rootkit is designed to not be detected, and that is the scary part."
As opposed to those root kits that are designed *to* be detected? Damn it, thinking again instead of being scared into buying something. Really need to work on that...
As opposed to the usual kind and gentle root kits, I suppose?
Isn't that part of what makes a root kit?
quidquid latine dictum sit altum videtur.
How many people still use .com files anyway?
Yahoo.com, Google.com, Fark.com, News.com.com... Windows stores Internet shortcuts in files with the .url suffix, but even when you have "hide file extensions" turned off, Windows still hides the .url suffix, making it nearly impossible to distinguish Google.com from Google.com.url in icon view and difficult in any other view. The little arrow in the corner doesn't mean much, as the Google.com file could contain an icon with the arrow already drawn inside.
Well this is true, it could just as easily be spread via email or something, but the relation to AIM is that once the virus (trojan, whatever you want to call it) gets into your system, I believe that it sends out messages to all of your contacts with the link, propagating itself.
.COM or .EXE files.
0 80.exe (It has since been removed -- the link is dead)
At least this is how several other IM viruses have been spread. I noticed that just this weekend I got several IMs from people that I haven't talked to in years (but who apparently still have me on their lists) which were nothing but links to
One of them was being hosted at this address:
http://home.earthlink.net/~two4tea/mc-110-12-0000
And I didn't get the other URL that was going around. I downloaded the file and opened it up in a hex editor just out of curiosity (I'm on a Mac so it wasn't possible to execute anyway), but there didn't seem to be any obvious text strings or anything.
What I wonder is how the file got up on that web site to begin with; it seems rather farfetched to believe that a virus could find out that someone has a Earthlink web page and upload itself, then send out that link, which makes me think that the person spreading the virus probably planted it there after somehow gaining access to the account, and then letting the version of the virus which points to that URL out. When the linked file is removed the virus stops propagating, but by then has already spread and nabbed a few unwary users. Unless the program has the capability of 'phoning home' to get the URL of the latest location to send out to everyone, that is. The file was a few hundred KB, so I suppose it's entirely possible that it has that capability; you could fit quite a bit of code into something like that.
Not really my area of expertise, but perhaps someone who knows something more can elaborate on how these things work?
"Ladies and gentlemen, my killbot features Lotus Notes and a machine gun. It is the finest available."
Actually it's more like the old adage about taking candy from strangers. "Here, eat this! You'll like it!"
Most people just don't make the mental connection that they could click on a link -- something they do pretty often and usually without incident -- and cause serious harm to their computer.
I vote that it's more ignorance (to a certain degree self-imposed, because a lot of people could understand a lot more about their computers if they wanted to, but simply choose not to) than a lack of ability or mental capacity.
"Ladies and gentlemen, my killbot features Lotus Notes and a machine gun. It is the finest available."
I can vouch for it.
And who are you?
When I was a kid, we only had one Darth.
He's TheGSRGuy of course.
When are they going to get around to full virus support? (I'm sticking with Windows 'til then.)
This looks like the same worm a friend of mine got a few weeks ago. I loaded it up in VMWare and discovered that it installed, among other things, the "FU" rootkit.
I took a rootkit class at this year's Black Hat Training from the guy who wrote FU. He pointed out that it's more of a proof-of-concept rootkit. It does allow you to hide files, registry keys and drivers from both user-mode and kernel-mode processes, but, it really doesn't go out of its way to hide itself from every possible angle, so detection (and thankfully, removal) wasn't that bad.
I was able to whip up a little app to fix it from within Windows. But had the worm's author actually expanded on FU's techniques and done a better job of hiding the rootkit, recovery would not have been as nearly as easy. (Just imagine how much fun would it be to talk a novice through Windows XP's Recovery Console!)
Once the worm authors start to get better at exploiting the potential of rootkits, we've definitely got a much better problem on our hands. The old "1. get infected, 2. run anti-virus to disinfect, 3. repeat" cycle just won't work anymore. Good luck even finding a well-implemented rootkit once it's in your kernel, let alone trying to clean it up while it's effectively able to veto every action you take.
(Yet another reason why no Windows user should run as an Administrator.)
"Power corrupts, and absolute power corrupts absolutely." -- Lord Acton
IE: The worm is a compact, surreptitious BT/Kademlia client.
:p
Took me a second to realize that "IE" meant "id est" and not Internet Explorer. And "id est" means "that is," not "for example," also known as e.g. (exempli gratia).
Handy cheat sheet:
i.e. = id est = that is (not commonly captitalized, or puncuated as an acronym like IE)
e.g. = exempli gratia = for example
There's your pendantic lesson of the day