Slashdot Mirror
Top Viruses, Worms and Malware in 2006
An anonymous reader writes "HNS is running an article with a list of those malicious codes which, although they may not have caused serious epidemics, stood out in one way or another. Some of the categories are: the biggest snooper, the most moralistic, the worst job applicant and the most tenacious. From the article: 'The most competitive. Once the Popuper spyware has installed itself on a computer, it runs a pirate version of a well-known antivirus application. Far from trying to do the user a favour, it is actually trying to eliminate any possible rival from the computer. It seems that the fight for supremacy has also reached the world of Internet threats.'"
Cleansing home PCs, I've seen some of the more exotic exploits become commonplace, including:
.DLL as a print monitor; .DLL, registered in a CLSID key, warning of SPYWARE!!! from the system tray; .DLL's.
Direct Revenue hiding its core
one lone
launching executables from Group Policy subkeys;
populating subkeys of Winolgon\Notify with self-renaming
Hiding malware so it launches before Explorer (and even before the antivirus app) is sneaky, underhanded, and ensures a steady stream of income so I don't need to get an actual job. Editing the Registry hives from WinPE is the only cost-effective way to remove many of these things, and Suzy Homeuser wull never be ready for that.
So here's to you, scumbag malware writers... and here's to Microsoft for leaving soooo many ways to launch your malware: Thanks for paying my mortgage. Without security holes, and the slimeballs who exploit them, I'd be back selling auto parts.
Apparently it only works properly on Windows... http://www.pandasoftware.com/com/virus_info/encycl opedia/overview.aspx?lst=det&idvirus=122900&sitepa nda=particulares
:wq
Well, you see, there are viruses for linux. However, they don't spread a lot (because if someone uses linux, he has enough knowledge not to open an attachment/install an unknown file.)
And well, saying that WIndows is bad because almost all viruses are designed for them is like saying that houses are bad, because thieves might try to break in...
Well, that's only part of the truth. There are three reasons why Linux viruses don't get around like Windows viruses; better security, lower population (also encompasses the lack of monoculture in network applications), and more careful users. And none of those reasons is the "real reason", they work in combination with each other to make the difference really really big.
It sure seems to have come down to a matter of simple denial with the Windows platform. Vista has barely been released yet, and there are exploits[0] out for it. How can anyone claim to be concerned about system integrity[1] *and* be a windows advocate at the same time? It is a blatant contradiction. There are so many different alternatives with a better overall design that it makes no sense to run Windows unless you have been locked-in to the platform. If you are not yet locked-in, it seems Vista will help you with that[2].
c urity+lacking1 2214
[0] http://www.google.com/search?hl=en&q=vista+virus
[1] http://www.google.com/search?hl=en&lr=&q=vista+se
[2] http://it.slashdot.org/article.pl?sid=06/11/16/01
boycott slashdot February 10th - 17th check out: altSlashdot.org
The time is ripe for a beneficial virus, one that does no harm to the host computer, but acts as a keylogger that will play a very loud annoying buzing noise and kill all open apps if the user types: "misa campo", "made of win", "internets", "begs the question", or any other word or phrase from a list of current phrases used by morons.
I see a lot of machines with multiple infestations, but I rarely rebuild 'em.
.DLLs (hint: sort the list by Manufacturer)
My usual algorighm:
Start up in Safe Mode
Use AutoRuns.exe to identify most of the offenders; delete those that don't self-reinstall
Open IE and then System Information; look at Loaded Modules to find the vx2
Boot to Windows PE; back up and load the Software and System hives & clean them up; do the same with the user hive(s)
Boot into Windows and check for stragglers.
Lots of fun, especially for $1.25/minute.
"The first time someone's running as root and downloads an untrustworthy file..."
.44 one by one.
But that's not really an issue is it? What Linux distribution has the default user as Root these days? In fact, it's more difficult to run as root in some distributions instead of as a normal user, in that the "root account" is never enabled. Attempt to login to (X,K,Ed)Ubuntu as root at the login screen and it won't work.
How to get a Windows computer infected:
Connect to the 'net without a firewall or run IE and visit a bad page. Or, run OE (interesting that Outlook Express has the same initials as "Operator Error") for your mail. Or run p2p software and download a "song" that doesn't play (but is instead an executable file). In fact, I've got a friend whose daughter did exactly the latter, and I'm going to fix it after the weekend. I beginning to think that these days, that's the most common vector of infection, as I see it time and time again.
Windows gives execute permission based on the file name extension. For this utterly stupid idea held over from the frickin' CP/M days, users are being hosed left, right, up, and down. This bogosity should have died with Windows 3.1 or at least after Bill Gates discovered the 'net and put out Win98. However, the concept is still with us in Vista, so techs everwhere are going to be guaranteed a paycheck for at least the next 5 years.
How to infect a Unix or Linux machine:
Automatically through mail? Impossible to do without user interaction, since everything that comes down the pipe doesn't have the execute bits turned on. Anyone who writes an MUA that does that autmatically will be taken out back and hit with the clue bat.
Visit a web page? There's no such thing as a drive-by install. The user has to download the file and manually set the execute bits high again, through chmod or by right-clicking on the file.
Use p2p? Everything downloaded has no execute bit. What data file _ever_ deserves an execute bit? Indeed, I have yet to ever receive a file from the wire that has execute bits turned on except when they're contained within an installation package, and for that to work, I need to pause and use root permission if it's an install for the whole machine and I still have to unpack it even if it's going in my home directory.
In fact, the simple act of user interaction, even if it's the typing of the current user's password (OS/X) prevents a whole lot of evil. It's that short pause that gives the user the chance to _think_, if even for half a second, and say _no_ to random malware. If you're a malware writer and you give your victims the chance to think, your bit of evil goes nowhere. There are only so many times that people are going to install a fucking purple gorilla.
This ignores the population that will run silly "cupholder" executables and trojan filled "free screensavers," at every opportunity whether in Linux, Unix, or Windows, but then real stupidity trumps artificial intelligence every time. You can only do so much if a user is determined to blow each toe off his foot with a
If this means that Unix and Linux are more difficult, (as if typing the current user's password is complex) so bloody what? It's damn inconvenient when a computer gets infected, isn't it?
--
BMO