Kama Sutra Worm Could Make For A Bad Friday

mikey1134 writes "CNN is running a story about the Kama Sutra worm, a virus that is coded to overwrite files of the (potentially thousands of) infected computers. They provide some background on this viral outbreak and warn users to protect themselves" From the article: "And even for home computer users who have never taken such precautions before, security experts say now would be a good time to back up your most important data, like financial information and family photographs, to CDs, DVDs, zip drives, or an external hard drive that you know is worm and virus free. Unlike a lot of malware that exploits vulnerabilities in the Windows operating system, there is no 'patch' that can be downloaded to ward off Kama Sutra."

Comments

Many Aliases and More Info

[eldavojohn]

For references, these are the enumeration names and where to go to make sure you have the latest anti-virus signature. Remember, this variant will uninstall and delete most anti-virus software so it's important to recognize it before it goes active tomorrow. Most virus definition software refers to it as CME-24. This is important since this worm has many different names including Nyxem.E, BlackWorm, Grew and Mywife.E.

More on the worm and its permutations and statistics on spreading.

A very detailed analysis with all types of files that may be affected.

And, if it's worth anything to you, the Microsoft advisory which seems to tout that Windows Live Safety Center Beta can protect against it. If you're in charge of computer security at your workplace, I would send out an e-mail instructing everyone to verify that they have the correct anti-virus definitions and to scan their computers before leaving tonight. Luckily, that's not my job where I work.

Re:Many Aliases and More Info

[rkrabath]

>> if i scan my hardrive tonighte with avg or macafee or norton, am i protected ?

Possibly yes, but also possibly not. This virus wil disable many common AV programs. My reccomendation would be to use a specialized scanner such as the one from f-secure: http://www.f-secure.com/v-descs/nyxem_e.shtml. I just used that one myself.

Re:Many Aliases and More Info

[j-cloth]

McAfee DATs 4642 and higher will catch it.

Re:Many Aliases and More Info

[Inda]

I know you're only trying to help but to answer the GP's post again.

Probably yes. That's a big 99.9% yes...

Yes, the Worm tries to delete anti-virus program files. Yes, tries to stop anti-virus software running at reboot. But if it's managed to do that, there's no way you're scanning your PC tonight anyway.

Update your definitions and scan now. Inform everyone you know not to open email attachments they weren't expecting.

Which brings me to another point: Do people really get hit with these anymore? It won't make it though all the major webmail services. You haven't been able to open *.PIF or *.SCR files in Outlook for years now. You almost have to go out of your way to get infected by email worms these days.

Don't get caught up in the media hype. This isn't another Blaster.

Obligatory Kama Sutra Comment

[sumi-manga]

Better back up that pr0n too! :P

Your computer...

[bondsbw]

... really should have more flexible security.

Write-once backups

[truthsearch]

The best backups are those written to only once. Burn to a write-once only CD or DVD. Don't back up to an external hard disk. As soon as you plug it in anything can happen, either from Windows itself or from malicious software (redundant, I guess).

In the old days we backed up to tape and flipped a switch so the tape couldn't be overwritten. Today it's burn-once disks. Don't trust anything but physical protections from disk writes.

Re:Write-once backups

[TubeSteak]

In the old days, we etched our words into stone tablets for safe keeping..

A destructive virus was when a sick person would start coughing so hard that they'd break tablets by knocking them over.

The cost of physical media was high & the write speed was slow. Back then, we went to a lot more effort to make sure that our backups stayed safe.

Re:Write-once backups

[charlesnw]

You evidently don't have a lot of data to backup. My nightly backups are almost half a terabyte. If I didn't reuse media, I would have a very hard time getting my budget approved. Media isn't cheap. 100 tapes is $10,000.00. Write once is nice but doesn't work in real life. Unless you have small amounts of data that fit on one TAPE or DVD. And if you have to store your backups (we have to store offsite for 7 years) you would be paying 2 arms and 3 legs in storage and handling fees.

Re:Write-once backups

[Anonymous Coward]

I remember those days. There was this guy called Moses who had received some seriously important data on top of some mountain. He goes down the mountain, and he breaks the tablets. He didn't make backups, so he had to go back to his client and ask for a new copy of the data. Very embarrasing.

That should serve as a warning to everyone; always make backups. Especially with important clients like that.

Oh yes, this

[voice_of_all_reason]

This is the virus that MS has a patch from their fancy new Remote System Control program, right? Simply agree to download and blindly run any code they decide to send, let 'em take a peek at what you're running from time to time, and send regular status reports to the nice windows home base -- and then, we'll protect you from the nasty viruses!

And remember, kids... that's a nice computer. Would be a shame if something were to "happen" to it, you know what I mean?

But but but we want a patch!!!

[Siberwulf]

"Unlike a lot of malware that exploits vulnerabilities in the Windows operating system, there is no 'patch' that can be downloaded to ward off Kama Sutra."

Half the articles i read yesterday about this said that the public was being screwed over becuase MS wouldn't release a patch.

The only patch for stupid is a swift boot in the ass.

Patch? How about a brain patch!

[Sporkinum]

Unlike a lot of malware that exploits vulnerabilities in the Windows operating system, there is no 'patch' that can be downloaded to ward off Kama Sutra.

How about a stupidty patch for opening up an attachment like the one described.

More Obligatory Kama Sutra Jokes

[fishdan]

So I guess Kama Sutra could put some IT professionals in some awkward positions

i have a patch

[tehwebguy]

just turn your computer off before midnight, and leave it off until saturday.

Zip drives?

[Dr. Sp0ng]

...to CDs, DVDs, zip drives, ...

What is this, 1996?

Strange...

[casualsax3]

Anyway I like how virus names are slowly getting edgier. Kama Sutra is a good one, but it'll be great fun when someone names a virus the Angry Dragon, Cleavland Steamer, or the Dirty Sanchez. I eagerly await the day when the words "Rusty Trombone hits America hard" grace CNN's frontpage :)

Clue About How To Detect Whether You're Infected

[Fleetie]

This URL would seem to provide some hints about how to check whether you're infected.
It mentions some registry keys that the worm sets up.

http://www.sophos.com/virusinfo/analyses/w32nyxemd .html

Re:Great reporting, CNN

[HaydnH]

"As much as I appreciate the warning, hints on HOW to know if you're infected would have certainly helped."

As much as I appreciate your comment, hints on HOW to know if you're infected would have certainly helped.

So I don't get the same response to this comment, here's some links to Nyxem/Karma Sutra/MyWife (Whatever you wanna call it) removal:

- Symantec
- McAffee

Haydn.

Go Ask Alice

[RobertB-DC]

From TFA:
"So while you might think it is coming from cousin Alice, most likely cousin Alice is not going to send you something that says 'Hey look at these pictures with naked people.' So that should be your first clue that a virus is propagating and you'd be well served to call cousin Alice to let her know that she is [unknowingly] sending out this type of e-mail," Sergile said.

Mr. Sergile, you obviously haven't met my cousin Alice.

Re:Go Ask Alice

[Kiaser Zohsay]

The really sad part is that it probably wasn't even cousin Alice who sent it, it was someone else who had both you and cousin Alice in their address book.

It could be worse. Alice could be your dad.

CME-24 aliases, information, and removal tools

[Futurepower(R)]

Here's how to know the difference between a money-making press release, and an honest story: The press release says "Fear, fear, fear!!!"

The honest story gives you links to tools for eliminating the threat: You can run this tool: W32.Blackmal@mm Removal Tool, which apparently removes all variants of the worm.

Here are manual instructions: WORM_GREW.A, Also known as: CME-24

Here is the list of names of the CME-24 worm, and links to removal methods: CME-24 aliases, information, and removal tools.

Even better

[databyss]

CasualSax's Rusty Trombone pounds the US in the IS.

Oh leave off it

[Sycraft-fu]

There's no patch because it's not a vulnerability, it's a virus. The only thing you can patch is the users that still won't follow directions and not open executable attachments. The OS is working as intended when it executes code you ask it to, which is how this virus gets on.

This "OMG MS won't patch t3h systems!!!11" stuff on Slashdot is getting old. No, they won't patch it because there's nothing to patch. Duh. They have decided to add it to the malicious software tool, which is a mini virus scanner akin to Stinger from Mcaffee, which scans for a limited subset of viruses, but that's not a patch. Windows OneCare, which is NOT a remote control system by the way, does find it because, well, it's a virus scanner just like any other. It catches it just like AVG, F-Secure, Norton, and so on, which is to be expected as it's a competitor.

So let's leave off the bullshit ok? There are two easy methods to prevent this from hurting your system:

1) Don't run random programs that some with e-mails. If you use Outlook Express, it'll even tell you not to (twice).

2) Get a virus scanner. Doesn't need to be MS's, there are many good ones out there. I recommend AVG, it's fast and free.

Don't I wish

[Sycraft-fu]

Here's my idea:

We setup a room. The door to the room says, in every language "Danger! Do not enter". Inside they'll be a cage you need to open, again with keep out warnings. Inside the cage will be a button that says "Warning: Do not push the button, death will result!". If you push the button, you die. We come in once a week or so and clean out the body.

My guess is any person likely to push the button is also the kind that'll open random attachments despite being told not to by us, the OS, their virus scanner, etc.

Problem solved :D

Re:Searches Network Shares

[Feebleminded_Genius]

Agreed. I've been chasing this down on our corporate network all week.

I installed this virus on a test network last night. It was ugly to say the least. The test network was comprised of 5 clients, 1 DC, and 1 file server. When I ran the email attachment on a client, it immediately froze, consistent with the description on F-Secure. Upon rebooting with monitoring on, it launched numerous processes, and disabled Symantec immediately. Within 4 hours it had infected the other 4 clients & the file server.

We then flipped the switch on the DC & set the date to 2/3/06. Update.exe launched half an hour after login, and within 4 hours all .docs, .xls, .mdb files etc were corrupt on the local machines and the file servers.

Note that this test was performed with out-of-date virus defs as a test.

Here's an idea for those in a corporate environment. Create a software restriction policy for the executables associated with the virus:
%systemroot%\system32\scanregw.exe
%systemroot%\system32\update.exe
winzip quick pick.exe
winzip_tmp.exe

We did this in our test environment and it halted the virus completely.