Slashdot Mirror
Kama Sutra Worm Could Make For A Bad Friday
mikey1134 writes "CNN is running a story about the Kama Sutra worm, a virus that is coded to overwrite files of the (potentially thousands of) infected computers. They provide some background on this viral outbreak and warn users to protect themselves" From the article: "And even for home computer users who have never taken such precautions before, security experts say now would be a good time to back up your most important data, like financial information and family photographs, to CDs, DVDs, zip drives, or an external hard drive that you know is worm and virus free. Unlike a lot of malware that exploits vulnerabilities in the Windows operating system, there is no 'patch' that can be downloaded to ward off Kama Sutra."
For references, these are the enumeration names and where to go to make sure you have the latest anti-virus signature. Remember, this variant will uninstall and delete most anti-virus software so it's important to recognize it before it goes active tomorrow. Most virus definition software refers to it as CME-24. This is important since this worm has many different names including Nyxem.E, BlackWorm, Grew and Mywife.E.
More on the worm and its permutations and statistics on spreading.
A very detailed analysis with all types of files that may be affected.
And, if it's worth anything to you, the Microsoft advisory which seems to tout that Windows Live Safety Center Beta can protect against it. If you're in charge of computer security at your workplace, I would send out an e-mail instructing everyone to verify that they have the correct anti-virus definitions and to scan their computers before leaving tonight. Luckily, that's not my job where I work.
My work here is dung.
Better back up that pr0n too! :P
... really should have more flexible security.
All my liberal friends think I'm a conservative, all my conservative friends think I'm a liberal.
The best backups are those written to only once. Burn to a write-once only CD or DVD. Don't back up to an external hard disk. As soon as you plug it in anything can happen, either from Windows itself or from malicious software (redundant, I guess).
In the old days we backed up to tape and flipped a switch so the tape couldn't be overwritten. Today it's burn-once disks. Don't trust anything but physical protections from disk writes.
Developers: We can use your help.
This is the virus that MS has a patch from their fancy new Remote System Control program, right? Simply agree to download and blindly run any code they decide to send, let 'em take a peek at what you're running from time to time, and send regular status reports to the nice windows home base -- and then, we'll protect you from the nasty viruses!
And remember, kids... that's a nice computer. Would be a shame if something were to "happen" to it, you know what I mean?
"Unlike a lot of malware that exploits vulnerabilities in the Windows operating system, there is no 'patch' that can be downloaded to ward off Kama Sutra."
Half the articles i read yesterday about this said that the public was being screwed over becuase MS wouldn't release a patch.
The only patch for stupid is a swift boot in the ass.
Unlike a lot of malware that exploits vulnerabilities in the Windows operating system, there is no 'patch' that can be downloaded to ward off Kama Sutra.
How about a stupidty patch for opening up an attachment like the one described.
"He's lost in a 'floyd hole"
...transfer your important data to a new hard drive inside of a Mac.
So I guess Kama Sutra could put some IT professionals in some awkward positions
Nothing great was ever achieved without enthusiasm
Like they learned from Happy99?
Keep in mind all of those Dells that ship with time limited anti virus trial software. Even if people know they need virus protection, they may not know that it's expired.
END OF LINE.
just turn your computer off before midnight, and leave it off until saturday.
-- lol pwned
...to CDs, DVDs, zip drives, ...
What is this, 1996?
Anyway I like how virus names are slowly getting edgier. Kama Sutra is a good one, but it'll be great fun when someone names a virus the Angry Dragon, Cleavland Steamer, or the Dirty Sanchez. I eagerly await the day when the words "Rusty Trombone hits America hard" grace CNN's frontpage :)
I'm sorry? It won't be super destructive? May I ask what you define as a super destructive virus? Overwrting the contents of all MS Office documents (not just deleting them) is extremly devestating. Even with backups the time it would take to restore the files would be a lot of downtime. Then you look at all the people who don't have backups. People and businessess. That could result in serious economic damage as companies are forced to re create there entire business. Was your post meant as a joke or...? You evidently have never had to recover from a virus infection of any magnitude. I have and its not easy. It takes time and its a race against the clock.
Charles Wyble System Engineer
As bad as this day? http://images.amazon.com/images/P/0689711735.01._S CLZZZZZZZ_.jpg
//mah favorite book
Sure. But I reckon gradually corrupting small parts of them is still worse. You might only realise you were infected months later, when the quarterly financial figures come out totally whacked, and you'll spend the rest of forever in the company of accountants and auditors trying to track down the correct figures.
Fragging out a file all at once? Then the victim realises something's up, gets the machine fixed, loses some work. Imperceptibly corrupting the file? Victim keeps spreading the virus, and every version of every file he works on is suddenly untrustworthy...
Real Daleks don't climb stairs - they level the building.
end up fucking yourself.
This URL would seem to provide some hints about how to check whether you're infected.
d .html
It mentions some registry keys that the worm sets up.
http://www.sophos.com/virusinfo/analyses/w32nyxem
"Absorbing your worst..."
I wouldn't call it a Microsoft insecurity issue, but a stupid user issue. The user has to install it for it to work, the user actually has to be involved and allow it onto their box. The same type issue can be had for a Linux box and you don't even have to be a root user to be affected; someone emails you unknown app and like these windows dumbasses you run it can wack all of the Openoffice documents you have been using to write your disertation for the past year is gone.
A stupid user is stupid user, the article summed it pretty well: "Unfortunately, there is no way to patch user ignorance, and the way this virus propagates is through user ignorance,"
"As much as I appreciate the warning, hints on HOW to know if you're infected would have certainly helped."
As much as I appreciate your comment, hints on HOW to know if you're infected would have certainly helped.
So I don't get the same response to this comment, here's some links to Nyxem/Karma Sutra/MyWife (Whatever you wanna call it) removal:
- Symantec
- McAffee
Haydn.
Time is an illusion. Lunchtime doubly so. - Douglas Adams
Try and get your knee to settle down and RTFA
Unlike a lot of malware that exploits vulnerabilities in the Windows operating system, there is no "patch" that can be downloaded to ward off Kama Sutra.
"This is something that is not inherent in the operating system," Sergile said.
"Unfortunately, there is no way to patch user ignorance, and the way this virus propagates is through user ignorance," he said.
I like to jump all over Microsoft for their lax security and gaping vulnerabilites as the next guy, but this time it isn't an unpatched hole in office or RPC or something causing this.
There isn't anything you can do to protect your system from this worm, aside from not being dumb enough to click on an email attachment that says "free nekkid pikturs".
>Hopefully this worm will cause a bunch of monetary damage to some corporations
Apparently not, just horny/stupid military and home users:
Furst says the worm has spread to a lot of military addresses on the Internet (.mil), but mostly to ISPs (Internet Service Providers), meaning most of those infected are probably home users.
There is much cruelty in the universe, John.
Yeah, we seem to have the tour map.
From TFA:
"So while you might think it is coming from cousin Alice, most likely cousin Alice is not going to send you something that says 'Hey look at these pictures with naked people.' So that should be your first clue that a virus is propagating and you'd be well served to call cousin Alice to let her know that she is [unknowingly] sending out this type of e-mail," Sergile said.
Mr. Sergile, you obviously haven't met my cousin Alice.
Stressed? Me? Of course not. Stress is what a rubber band feels before it breaks, silly.
This one will be more damaging than people think.
A lot of SMEs uses unsecured and passwordless network shares for sharing company data. Data that is stored in, you guessed it, *.doc *.xls, etc, etc files. This virus looks for shared drives such as this and will corrupt the files on them tomorrow.
If only one PC in the company is effected, I can see a whole lot of sore heads tomorrow at lunchtime.
I guess I should have paid more attention to this one.
May the Maths Be with you!
"Unfortunately, there is no way to patch user ignorance, and the way this virus propagates is through user ignorance,"
:-)
Isn't the purpose of this article to patch user ignorance?
If I were more creative, and funnier, I would come up with many witty and similar analogies to the phrase "patching user ignorance."
I feel a sudden illness coming on, could be a virus.
He who knows best knows how little he knows. - Thomas Jefferson
Here's how to know the difference between a money-making press release, and an honest story: The press release says "Fear, fear, fear!!!"
The honest story gives you links to tools for eliminating the threat: You can run this tool: W32.Blackmal@mm Removal Tool, which apparently removes all variants of the worm.
Here are manual instructions: WORM_GREW.A, Also known as: CME-24
Here is the list of names of the CME-24 worm, and links to removal methods: CME-24 aliases, information, and removal tools.
This is because, while it may have been posted before, this is very helpful for some of us who are looking for resources to make sure we are covered in the last day before the attack. If it wasn't for the links I got off slashdot, I couldn't get my PHB's to approve my time to verify everything. Thus, an article is not a "dupe" if it is still useful. Hence, your complaints are offtopic.
As was this.
Watch for Penguins, they eat Apples and throw rocks at Windows.
CasualSax's Rusty Trombone pounds the US in the IS.
Hmmm witty sig or funny sig? Maybe elitest techy sig!
Step 1: Go into Date and Time properties Step 2: Click on Internet Time tab Step 3: Uncheck Automatically Synchronize Step 4: Click on Date & Time tab Step 5: Change the date to the 4th (saturday) Step 6: Click OK Step 7: Wait until it really is saturday and turn automatically synchronize back on. I'd reccomend this for everyone, whether you think you have it or not, just to be on the safe side.
Maybe you haven't worked with companies having fewer than 100 billion dollars in assets; but I provide software and services to credit unions and I assure you, they cannot afford to use a SLDT 320 GB tape once and archive it forever. The monthlies are (if they follow our recommendations) put away indefinitely, but that's about it. There is a reason to reuse tapes, and it's called "practicality." They couldn't open their doors to teenagers and low-income families if they had to do what you demand.
Gamingmuseum.com: Give your 3D accelerator a rest.
There's no patch because it's not a vulnerability, it's a virus. The only thing you can patch is the users that still won't follow directions and not open executable attachments. The OS is working as intended when it executes code you ask it to, which is how this virus gets on.
This "OMG MS won't patch t3h systems!!!11" stuff on Slashdot is getting old. No, they won't patch it because there's nothing to patch. Duh. They have decided to add it to the malicious software tool, which is a mini virus scanner akin to Stinger from Mcaffee, which scans for a limited subset of viruses, but that's not a patch. Windows OneCare, which is NOT a remote control system by the way, does find it because, well, it's a virus scanner just like any other. It catches it just like AVG, F-Secure, Norton, and so on, which is to be expected as it's a competitor.
So let's leave off the bullshit ok? There are two easy methods to prevent this from hurting your system:
1) Don't run random programs that some with e-mails. If you use Outlook Express, it'll even tell you not to (twice).
2) Get a virus scanner. Doesn't need to be MS's, there are many good ones out there. I recommend AVG, it's fast and free.
It will most certainly affect any writeable permanent redirected shares, AKA mapped drives, since the whole point of mapped drives is to create something that looks like a regular local storage volume.
It will *probably* walk the local network and affect nay shares it can access.
But - why take the chance? Always assume it will affect anything it could possibly write to.
Here's my idea:
:D
We setup a room. The door to the room says, in every language "Danger! Do not enter". Inside they'll be a cage you need to open, again with keep out warnings. Inside the cage will be a button that says "Warning: Do not push the button, death will result!". If you push the button, you die. We come in once a week or so and clean out the body.
My guess is any person likely to push the button is also the kind that'll open random attachments despite being told not to by us, the OS, their virus scanner, etc.
Problem solved
but Macs have been impervious to every big, newsworthy Windows virus in the past five years.
Well no shit. My Ford has been impervious to every big, newsworthy Chevy recall in the past years.
Bad boys rape our young girls but Violet gives willingly.
"There is no 'patch' that can be downloaded to ward off Kama Sutra."
That's right. Once you get the Kama Sutra, you're fucked!
They can't hide that they are apps. Windows will warn you that it's an app, and tell you not to run it. You don't need to run as an admin to run Windows. We have hundreds of computers in the department which users do not have admin access on. People run as admin because they are lazy. Besides, if your e-mail client saying "Warning, this could be a virus don't run it" and then your OS saying "Warning this oculd be a virus don't run it" isn't enough, changing the OK to a password field isn't going to do any good.
I'm using FreeBSD, am I safe? I think I am, but with all the panic swirling around over this issue, I'm not sure. Some guy just ran past my cubicle screaming, "no one is safe!"
A Government Is a Body of People, Usually Notably Ungoverned
May I ask what you define as a super destructive virus?
:)
If it infected my FreeBSD desktop and wiped out my text and OpenOffice files. Now THAT would be devestating!
OTOH, if it's just Windows... eh, not that big a deal. Must be a perspective thing
The line must be drawn here. This far. No further.
They can't. When you try and open attachments you get a dialog that tells you it's a bad idea and the default response set to "Don't Open". Applications should not be able to edit the registry without warning the user.
How is the OS supposed to tell the difference between a legitimate registry change and a malicious one ?
Users should not need to run as Administrator to make their computers work properly.
I agree. Blame the people who are writing software that does, it's their fault.
The registry is itself pretty sucktastic as far as security design goes.
Bollocks. The Registry has per-user ACLs on each key. It's got a better "security model" than most OSes.