Slashdot Mirror
New Worm Starts Munching MSN Users
Kosmik writes "It appears that MSN has been struck by a vindictive new worm, according to security company Panda Software. The worm, acting in the vein of movies like the Ring and FearDotCom, delivers a fateful terror message and then proceeds to disable most of your protection software like anti-virus,firewalls and even your Windows control apps (TaskManager, Regedit). It distributes itself to all your MSN contacts by sending a video called 'Fantasma.'"
So I connect to the MSN network but through a nice free little app called GAIM.
... or if it was a design decision by choice to avoid hidden viruses that the codecs unpack in the media files. Probably the latter.
My friends often try to send me files or pictures or videos through the MSN network and it doesn't work. They get annoyed and tell me to "just use MSN." I'm told that GAIM is stupid & crappy for not supporting these features.
Really makes you wonder if the people who developed gaim couldn't figure out how to make the videos/pictures stream through the chat box
GAIM also works on a number of other chat networks--as chat clients should. Another thing about chat clients is that they should stick to limited functionality. There are way more secure ways to transfer files. I don't want a profile, I don't want it integrated with my operating system (married to the kernel), I don't want media streaming, I just want to chat.
Don't bloat your software.
My work here is dung.
"on the 1st day you get scared, on the 2nd you get desperate, on the 3rd you look for help and on the 4th you die"
Panda did not provide information about the payload of the BlackAngel.B worm.
I think it's pretty clear what the payload is. Somebody better get a fix out for this quick...Like in the next 2 or 3 days!
This guy's the limit!
Or on windows, you could try Miranda
http://www.miranda-im.org/
A CNN poll taken recently showed that 98.1% of US citizens would rather have the MSN virus on their computer instead of the 1990 film in Spanish.
It's so unfortunate that we haven't invented the technology to "unwatch" films yet.
My work here is dung.
Thanks for 3rd party apps like GAIM and Trillian.
?SYNTAX ERROR IN LINE 42
I find a few hits to the head with a blunt object works pretty well. Just make sure there aren't any sharp objects around you could hit in your fall.
I never spellcheck and I freely admit it. Save your karma for more worthwhile "lol erorrs" replies
New Worm Starts Munching MSN Users
In other news, Hollywood announces the production of Tremors 4: Attack of the Microsoft Munchers.
"You will pay for your lack of vision..." - Emperor Palpatine to Ray Charles
Trillian is another popular choice, although if you want Google Talk/Jabber and plugin functionality you have to shell out a few extra $$$. Even though I have I'm still looking at Miranda... the latest alpha looks nice.
The most annoying thing about this though is that some of the protocols don't support buddy list groups, or at least Trillian doesn't, because if I connect to my accounts from another computer with Trillian or from another OS, my groups pretty much explode. It's very annoying. I don't think there's anything the Trillian dev team can really do about it tho.
The only certainties in life are taxes and death, but it seems that it should be ammended for windows users with virus/worm infections.
So, did you pay taxes lately?
This space is intentionally staring blankly at you
A trojan/virus/etc. that disables regedit and the task manager - and monkeys with files. This is not A Good Thing.
Many corporations support MSN Messenger only. Given a choice, however, I'm very fond of Trillian Pro 3. I found the license price for Trillian to be quite reasonable, considering its flexibility, stability, and the fact that (so far, fingers crossed) it has not been subject to attacks such as this.
A Passionate Independent Musician
This is so going to happen to my sister, and I am so not going to fix her computer this time.
Remember kids, don't constantly insult the person who fixes your computers.
Does it make you happy you're so strange?
I don't much approve of destructive viri, but if they're going to be out there, they might as well have a little character to them. Who needs yet another boring old "spams your adress book and erases your HD" routine when you can be 0wned by something just a bit more interesting?
Reminds me of the good old days of "gimme a cookie."
Slashdot Burying Stories About Slashdot Media Owned
From the article:
Ummmm... here's a hint: if somebody sends you a random URL to an executable, don't run it!
The More You Know
The Online Slang Dictionary
a video called 'Fantasma.'
Anyone read this quickly as 'Futurama'?
Normally I will question the brain of anyone who clicks a link without confirming with the person who sent it that it's not a virus, but all my friends know I love futurama clips.
Good news everyone, I can be socially engineered.
Anyone else have a hard time here reading Slashdot now that it's gone to this new layout/theme?
I used to.
Is there any way I can go back to a Slashdot that values content over style?
Yes. Install Stylish, and then go here or here.
Through a vulnerability in MSN messenger, or is it just the usual "click here to get infected" method?
Lots of people complain that P2P is unsafe because it carries virusses and what not. So how come I have never been infected?
Obvious it is because of my enormous intellect that makes einstein look stupid and think that a 15mb .exe files claiming to be a movie is suspicious.
Yes granted the recent WMF crap showed us that if you use MS software any file extension is under suspiscion and the design choice by MS to hide the extension by default must rank as one of their most stupid one (then again this is ms, they make so many it is hard to determine wich one was their worsed).
But GAIM does not protect you from being stupid. Nothing does. Just that if you went through the trouble of installing GAIM on a Non-MS machine, or if you are on a MS-machine deliberatly disabled MSN and installed GAIM, then you are probably not that stupid.
It ain't GAIM that is keeping you safe, it is your brain. Trust me on this, I been around long enough to know people will do anything to get infected. Just promise them a juicy picture. We have about the same chance of stopping computer infection as we have of stepping Sexually Transmitted Diseases. When Miss Jpeg flirts with you, you don't think of using a condom. (Oh and using a condom isn't enough, deep kissing can do it too. How many of you practising safe sex make sure no fluids whatever are swapped?)
MMO Quests are like orgasms:
You may solo them, I prefer them in a group.
from Pandas webpage
Countries affected
España 2.42
México 2.15
Perú 0.71
Chile 0.33
there are NO english speaking countries affected and the original site which hosted the file is dead (file removed i looked)
if today is AV fud promotion day you could at least try and scare us with a virus that affects English speaking countries
At least death doesn't get WORSE every year!!!
The dangers of knowledge trigger emotional distress in human beings.
Correction -- New work starts munching STUPID MSN Messenger users.
If you accept an unsolicited download, you deserve everything you get. This bug can be protected against with a simple "What is this you're trying to send me?".
It's been a long time.
News up next - Ursine defecation in arboreal context and spiritual leader found in Rome.
In this case the user is clicking on a hyper link in the IM Conversation which uses a web browser to download an external application. If someone on your buddy list sent you this message, it would come through with no problems. You could click the link and download the file with no problems. It could even execute it's payload while you are wrapped in your GAIM blanket of security. The only thing that it MIGHT not be able to do is to propagate itself to all of the members of your friends list.
-Rick
"Most people in the U.S. wouldn't know they live in a tyrannical state if it walked up and grabbed their junk." - MyFirs
Yeeaahh.. that scenereo describes why there's such a rich open source development community quite clearly. And why so many open source libs are being used by actual corporations.
Oh. Just in case you're too stupid to realize: I'm calling you a judgemental moron.
110100 1101000 1101000 1100110 0 1101111 1101000 1100011 1
This doesn't sound like a virus, More of a bug fix for windows. Any change is an improvement.
Mod others as you would have them mod you.
I've always been concerned that the IM clients we use would be a threat some day. I didn't have any reason other than lots of people use them all of the time and by their very nature they allow people to reach out and touch you RIGHT NOW.
.NET capability already deployed on the Windows machines. So it's very easy to get lots of cool extras with little effort. Kind of a bummer someone is exploiting it. It's my guess MSN was hit first because of the number of subscribers. I'd suspect something like Trillian or GAIM to have more security holes.
I'm not surprised that MSN got hit first (or at least in a major way). M$ tries hard to do just a bit more than the basic solution because it's easy to do so. They have a lot of great COM and
Slashdot.. where people join together in deliberate ignorance.
"I'm calling you a judgemental moron."
There are a lot of them on the Net these days in every aspect conceivable. It sucks, don't it? So many people that are deliberately ignorant.
Slashdot.. where people join together in deliberate ignorance.
Someone I met online recently sent me this message:
"I got my MSN names from http://www.im-names.com/ they're free!"
After getting this person to clarify that it was sent automatically. I said "OK, that's spyware." They said "I don't care." They are now blocked.
Gaim and some common sense means I'll never actually get the spyware, but it doesn't mean I won't get annoyed by it. After all, remember chain mail? I used to get chain IMs all the time -- "Send this to 25 friends by midnight and something good will happen!".
Really, the only solution, no matter what your IM client, is to start blocking morons.
Don't thank God, thank a doctor!
Who cares about Microsoft these days? They were a pain in the ass back when they'd buy out or simply put out of business any company with an interesting product, but these days they're becoming top-heavy and can't play the game by those rules anymore. Instead of trying to screw people terribly, they've started trying to make software people actually want to use, and it seems to me that they've succeeded on many fronts. If you're not a doorknob, Windows XP is ridiculously stable, and with the correct preventative measures in place (not using IE, using the built-in SP2 firewall), it can definitely be "secure enough". My machine is never turned off, it just runs and runs.
Besides, some people do OSS programming because they enjoy programming. Myself, You couldn't likely pay me to be a programmer(mostly because of the higer wages, job satisfaction, and survivability of my current trade), but I've got a few open source projects, including one on sourceforge, and I've contributed some code that does some very cool things to a few fairly high profile open source projects, and I've had a grand time doing it.
Man needs more than work to keep him alive. If the results of those labours happen to be a great piece of software (and natural selection in the form of users will see to that), then so be it. People who are involved with "this linux thing" because they hate microsoft aren't programmers, they're kiddies taking part in fame wars on slashdot. The vast majority of them have never written a line of code in their lives and couldn't if they wanted to.
It's been a long time.
Should be changed to "New Worm Starts Munching MSN Messenger Users". The MSN Messenging network and MSN are two different things.
w00t
Not a bad album either, if you're into odd electronic music.
burrocrisy
and that would be what? Ruling by jackasses? Never has a slashdot misspelling been more apropos
En el 1er día te espantas, en el 2 te desesperas, en el 3 buscas ayuda y en el 4 mueres.
On the 1st day you are frightened, on the 2nd you are hopeless, on the 3rd you look for aid and on the 4th you die.
What a nice person, eh?
I not saying nuffing, but didnt MS just launch a pay for service to fix problems like this?
No. In the real world, if BIG CORPORATION depended on COOL, they would have hired INHOUSE DEVELOPER 1 and 2 to support COOL, or even just SYSADMIN 1 to just keep the thing running.
:(
If EXECUTIVE 1 and 2 use software which isnt feature-stable in their CORPORATE ENVIRONMENT, they are STUPID EXECUTIVE 1 and 2, also their IT DEPARTMENT should be fired for not opposing the usage of the alpha-quality software in the corporation.
Now, the pun.
DEVELOPER 1: Hey, lets make something USEFUL.
DEVELOPER 2: Ok, fine. We'll licence it as Open-Source, and charge for support.
(Meanwhile)
SOFTWARE HOUSE EXEC: Programmers. Please start working on BLING. My marketing dept says it should have feature X, Y and Z for us to earn BIG CASH.
(Some time passes)
BIG CORP 1 EXEC: We are going to use USEFUL for our accounting. Hire INHOUSE DEVELOPER and SYSTEM ADMINISTRATOR.
BIG CORP 2 EXEC: We are going to use BLING from SOFTWARE HOUSE because it has feature X, Y and Z.
Some years pass. BIG CORP 1 and 2 are happily using USEFUL and BLING respectively. DEVELOPER 1 and 2 died in a freak car crash/lightning/stabbing accident. Nobody develops USEFUL anymore, except for INHOUSE DEVELOPER, with SYSTEM ADMINISTRATOR to help him.
SOFTWARE HOUSE: Hey, BIG CORP 2. We can see that your entire corporate infrastructure depends on BLING. Also, we're not gonna patch SECURITY ISSUE 1, 2 and 3 unless you pay many more BIG CASH.
BIG CORP 2 EXEC 1:
SOFTWARE HOUSE: Hey BIG CORP 2. We're closing down our business. Better migrate to some other software which is like BLING.
BIG CORP 2 EXEC 1: Ok, but can we have source so we can develop it ourselves?
SOFTWARE HOUSE: Nope. Corporate secret.
BIG CORP 2 EXEC 1: Ok, but can you atleast document the format in which all of our corporate data is stored?
SOFTWARE HOUSE: Nope. Corporate secret.
BIG CORP 2 is screwed and ended up paying much more BIG CASH than BIG CORP 1, because they depended on SOFTWARE HOUSE to support BLING, while BIG CORP 1 actually saved a lot of BIG CASH because they optimized USEFUL to suit their needs over time.
Or is it using an exploit in Media Player and inhabiting something that's actually a movie file? The foggy article doesn't say, and the news section at Panda's site doesn't shed any more light. In fact it talks about both a 'movie" and about "code'.
GAIM is obviously a load of complete rubbish because it doesn't support this functionality.
GoogleTalk deserves the same ire - you can't do anything with that except send instant messages - that's not what IM was invented for. Harumph! What would Google know about the Internet, anyway.
When will these people learn (as Microsoft have) that not being allowed to destroy our own machines and everyone else we know and spend days trying to get back to where we were is not a feature - it's clearly a bug. We enjoy rebuilding operating systems!
Genesis 1:32 And God typed
*crunch* *crunch* *swallow*
Hmmm... tastes like chicken.
If Nalgene water bottles are outlawed, only outlaws will have Nalgene water bottles.
Can't write a single line of code? How hard could it be?
#include
int main(){printf("Hello World");return 0}
Personally, the only people I know who have even heard of slashdot are 'programmers'. And every one has written at least one line of code in their lives. That doesn't make them any good, or knowledgable. I knew nothing myself until I got an internship (3rd year now). But I don't know anyone from school who is involved with 'this linux thing', including myself. College kids aren't interested. They only want benefits without paying for them.
Those people actually involved in 'this linux thing', like my dad, do so because they don't like others controlling them (i.e. Microsoft). There is no real unity because everyone does his own thing. It sounds to me that you are the flamebait, sir.
And over there we have the labyrinth guards. One always lies, one always tells the truth, and one stabs people who ask t
What you don't understand is non geeks are afraid of computers. When people are afraid they cling tightly to what they know whether that's a rational decision or not. To someone who is afraid and who lacks knowledge the unknown is terrifying, what if the new software is worse they think? They have zero understanding of things slasdot geeks take for granted like file formats, Unix user permissions, etc, all they know about the computer is next to nothing and their fear from bad things that have happened in the past
Never mind the fact that the fear of computers in turn comes from from bad engineering decisions from M$. Obviously educating people is the answer but it's not easy when you are dealing with people who are afraid and only want to know the minimum about their computer to just chat, e-mail, surf the web, word process, and look at pictures from the kids from their digital camera.
I could write a whole 'nother diatribe about fear, the "war on terrorism," Bush, and the abrogation of our civil liberties but I'll refrain for now. Suffice it to say fear is a powerful emotion that helps Bush and M$.
Tired of all the isms, don't exploit people as an employer, or a government, mmmmK?
Or am I the only one who thought that when they read what this virus did?
I mean, come on - a virus/worm/trojan attacking a Microsoft application/"service"??
Isn't this like announcing "water passes through a screen door"?
If you're going to insist on using a collection of security holes held together with a little bit of application code, you've pretty much got to expect this kind of thing.
--- Asking inconvenient questions for over 30 years...
Q. What is the plural of virus?
/ v/virus.html
A. Viruses.
It is not viri, or (which is worse) virii. True, the word comes directly from Latin, but not all Latin words ending in -us have -i as their plural. Besides, viri is the Latin word for 'men' (plural of vir, man, the root the English virile). There is in fact no written attestation of a Latin plural of virus. If you would like to pursue the subject further, see the excellent article "What's the Plural of 'Virus'?". If you have some knowledge of linguistics and Latin, you might be interested in the morphological analysis of the word from the Perseus Project.
http://dictionary.reference.com/help/faq/language
I see there are a few replies from ACs here, which probably are pointing out the same thing, but I don't read AC comments...
"But this one goes to 11!"
OMG How dare you correct my grammar blah blah. Actually, thank you! I did not know that, and have been saying it wrong all these years.
I do know, however, that I misspelled "address." And I don't regret that in the slightest.
Slashdot Burying Stories About Slashdot Media Owned
So, the only reason you like Open Source is because it's not Microsoft? That's unfortunate for you. If that's NOT the case, then your reply is just a straw man. For me, the majority of good open source developers I know have no great LOVE of microsoft, but are universally more concerned with making their own projects, rather than griping at Microsoft.
-- And no, the vast majority of slashdotters likely couldn't write a line of code if their lives depended on it. Just because you're a programmer doesn't mean everyone is. If you want to be literalist, they couldn't code their way out of a wet paper bag. I, of course, could make my way out of my wet paper bag using my Power Destructitron X.
It's been a long time.
Ummmm... here's a hint: if somebody sends you a random URL to an executable, don't run it!
TFA is wrong then - if you have to execute anything, it's not a worm. A worm infects your system via a security hole in an application andneeds no user assistance (well, sometimes the user has to neglect to apply patches or run a firewall).
This is not a worm. It is a trojan. I wouldn't trust any information from the web site, since they don't know their wormy ass from a hole in Troy's ground.
Nothing at SecurityFocus about this, they're talking about the Yahoo worm shich actually IS a worm:
If you can't get into your house, call a locksmith, not a carpenter.
So I communicate to others but through a nice free little thing called letters
... or if it was a design decision by choice to avoid hidden viruses that the codecs unpack in the media files. Probably the latter.
My friends often try to send me files or pictures or videos through the "internet" and it doesn't work. They get annoyed and tell me to "go online." I'm told that snail mail is stupid & crappy for not supporting these features.
Really makes you wonder if the people who developed writing couldn't figure out how to make the videos/pictures stream through the mail box
Do you also rail against email attachments? Oh wait GAIM is OSS so it's automatically better even if that betterness manifests in a lack of basic features.
I feel comfortable knowing that a number of scientologist-run companies like Panda and Sunbelt are using L. Ron Hubbard's tech to find security breaches.
The left side panel, the one with the menu list, keeps crashing my browser on my old computer. The only way I was able to get some stability was by setting Slashdot to "Low Bandwidth" on the home page preferences.
Slashdot should give an option to keep the old design for those that want it. The site was more stable with the old design, and use to load faster.
Just in case you're too stupid to realize: it's scenario.
It's the chyropractor approach and it gets rid of that pain in your neck. You've got diphtheria. I'm gonna crack your bones. You've got a virus. I'm gonna wipe your HD.
--Rob
Towards the Singularity.
Who said Gaim "is try mimic MSN functionallity"? Gaim itself sure doesn't! http://gaim.sourceforge.net/about.php Besides, the parent might just have been joking...? "When will these people learn (as Microsoft have) that not being allowed to destroy our own machines and everyone else we know and spend days trying to get back to where we were is not a feature - it's clearly a bug. We enjoy rebuilding operating systems." I'd almost think you were joking, but there is nothing funny in your post.
Alturin.
The easiest way to avoid viruses and worms is to make yourself incompatable. You may be able to download viruses through MSN Messenger on Macs or another open-sorce Instant Messegeing app on Linux, but as far as I know, the virus would simply do nothing.