Slashdot Mirror
Clock Ticking for Nyxem Virus
DoddyUK writes "The BBC is reporting that the countdown has begun for the Nyxem virus. On February 3rd, common documents such as MS Word, Excel or Powerpoint will be overwritten on infected machines. Over 300,000 machines have been infected thus far, the main method of infection being the promise of porn in unsolicited emails."
Ouch.
From TFA: Honestly, are there still computer users out there...even regular users...who don't know this is a bad idea by now???
____
~ |rip/\/\aster /\/\onkey
Darwin's virus, you could call it. As long as it disables their internet access too, I don't see the problem.
From the article:"It shows a certain intelligence in its design but what's the motive?" he asked, "Pure vandalism does not ring true these days."
:P
Maybe economic chaos? The virus goes after MS Office files and pdfs, the files that are 9/10 the most economically valuable on a PC. I wonder what the impact of getting rid of massive amounts of these files would be?
On the plus side, lazy grad students can now say, "The virus ate my thesis"
Monstar L
I'd fancy a virus overwriting common software such as MS Word, Excel or Powerpoint.
Jokes aside. A colleague wrote to the department to look out for the virus, backup all documents, bla bla.. I replyed, being the one who installed the av software, that updates are run hourly and that everybody is safe if they apply the same precautions which they usually (should) do.
So who is right? Me or the colleague who eventually said that my reply to all was conterproductive?
We've had all sorts of warnings about this bugger, but I've yet to actually see an infected machine.
Is this just hysteria whisked up by the AV vendors?
jh
Was the parent modded insightful for the possibility of economic turmoil, or because of the idea to get grad students off the hook? I mean, this IS Slashdot...
"A wolf's eyes can see into your soul"
My writing
Israel forcibly removes it's own people from all of the settlements in the west bank, paving the way for an inevitable Palestinian state, as as thanks, the Palestinians elect the party hell bent on the destruction of Israel.
If I were Israel, I'd be figuring out the best way to push the Palestinians into the sea. (And then I'd nuke Syria, just as a means of saying to the rest of the Arab world that we're done 'trying to work things out.' No more escalation of force... From this point forward, we come out swinging.)
They breed.
Now's a great time for porn-enjoying Windows users to switch to Linux! All the fun of free Internet porn with none of the viral infection.
"Software is like sex; it's better when it's free." -Linus Torvalds
That being said, the web would probably be a bit scarier place if viruses/software had that kind of physical power...
On the hopefull side, the more people who get burned by something like this, the more likely they are to take precautions in the future.
Oh, and to those with similar points of view to mine in the IT industry, do any of you worry that you're going to get tagged with the blame when a chunk of your users lose some of their important docs? "It's the tech's responsibility to keep bad stuff off the network", after all.
Z
And a lot of people at work couldn't do anything about it if they wanted to and were aware of it. Accidental changes to the OS such as infections are tolerated (you might get a lecture and a warning to stop being an idiot),but purposeful mucking about in the system (to attempt to clean it yourself) is forbidden and cause for dismissal.
People on home computers are a differnt story altogether. it is hard for people to keep clean systems,and people get emails that look like they came from a friend. You are expecting 100% clean, and even if home users manage 99%, that means 1% non-clean, and as such they are called lusers. Uhh, why? THAT system is terribly broken and you really can't expect normal non coding non IT professional people to be able to deal with it when the professionals haven't come up with a workable solution yet, one that has been universally implemented across the operating system and ISP board. There are various plans, schemes and work arounds for the broken email system, and for the broken web surfing system that is now encouraging massive adoption of active scripting which exponentially increases chances of infections, but it is by no means a fait accompli yet. We still (basically) have the same insecure email system we had decades ago, and the web surfing experience is more insecure by default design. The professionals have insisted and implemented bling over security, year after year after decade. It's really only been in the past year that the big three desktop OSes, windows (all service patches included), mac (ditto), linux (major vendors got a clue and turned services off in default installs), shipped anything even remotely secure out of the box, and that still doesn't address the broken email system.
The problem is that everyone alive today is the descendent on a *continuous* stream of hundreds of generations of people with an interest in sexual intercourse. Everyone who didn't have that interest didn't reproduce. Sex doesn't just sell, it drives most things that we do.
-russ
Don't piss off The Angry Economist
Comment removed based on user account deletion
From McAfee site it has beening covered since 02-12-05? (Minimum DAT: 4642 (12/02/2005) People should be updated by now....
DoddyUK writes "The BBC is reporting that the countdown has begun for the Nyxem *Microsoft Windows* virus. On February 3rd, common *Microsoft format* documents such as MS Word, Excel or Powerpoint will be overwritten on infected *Microsoft Windows* machines. Over 300,000 *Microsoft Windows* machines have been infected thus far, the main method of infection being the promise of porn in unsolicited emails."
jfs
The only thing worse than a Democrat is a Republican.
This virus is very likely a POC and an advance guard to hold doors open for future infection or botnets.e ncyclopediaSearch.do?method=viewVirusDetailsInfoDi rectly&fid=119856
I'm not an expert on this mechanism - but I'd assume that any machine with these "bad" trusts in place could easily be compromised later using code that is authenticated against these bad keys.
t ails.aspx?name=Win32%2FMywife.E%40mm as well as a few AV pages. None mention these keys, so I would assume they don't fix this problem.
As stated by others already, LURHQ has distribution stats. http://www.lurhq.com/blackworm.html US infections only number about 5% of total. Peru and India have most of the worldwide population of this. (this is ip-based, and may not be reliable.)
I haven't seen another mention, but SANS Storm Center has been following this - and actually has made an offer to sysadmins to share info. They limit the info they will give; if you can reasonably establish that you are the RP for a network or subnet - they will send you a list of known infections in your IP range. They have already sent out notice messages to admins of record (whomever the abuse or tech contact is currently on the whois lookup) using a script. [Check the ISC pages if you really want to know - I don't want to flood them by posting a direct email link here.]
Referred to in the SANS/ISC history on this http://isc.sans.org/blackworm and previous pages - Fortinet has done extensive analysis. This virus has several actions. Most folks already know it deletes files, breaks AV software, and spreads over Windows shares. What hasn't seen much daylight is that it drops a bunch registry entries that grant "trusted" status to the virus. http://www.fortinet.com/VirusEncyclopedia/search/
I read M$' page on this virus, http://www.microsoft.com/security/encyclopedia/de
Any system that has been infected and then cleaned will probably retain these falsified certificates. This leaves a big hole in place, while some users (even the " all your AV is updated hourly folks.. return to your seats" IT guy) - will have a false sense of security on this.
Thankfully, many AV programs discovered this virus Heuristically. (see links to LURHQ & others) McAfee, Panda, NOD32, and several others identified blocked this virus without needing a signature update. This may be why we don't have 2 million AOL/Comcast sheep spreading the virus.
This should serve as a strong reminder to backup religiously, use defense-in-depth, and enforce strong registry policies when Windows systems are implemented.
It does just infect MS OS, but it claims to delete some useful file types also (pdf comes to mind, there are probably more).
A destructive worm is a real throwback to old school nastiness. Who hasn't learned the lesson that destroying the host (or at least attracting attention) really diminishes the lifespan of an infection.