Slashdot Mirror

← Back to Stories (view on slashdot.org)

When Malware Attacks Malware

Posted by kdawson on from the internecine dept.

PetManimal writes "Researchers say that the Storm Trojan/Peacomm worm has been tweaked to spread via IM programs and attack rival malware. Symantec sounded the alarm, and says that the exploit launches in AOL, Google Talk, and Yahoo Messenger windows that are already open, making it appear to be a legitimate message from a known user. The worm has modified the code from last year's Nuwar worm, and when activated, enables a DDoS attack against any site, including antispam services and servers supporting rival malware: 'Systems hijacked by Peacomm have also conducted DDoS attacks against at least five domains used by the creators of the noted Warezov (or Stration) worm. After a busy September and October, Warezov was credited by some analysts as the genesis of 2006's massive fourth-quarter spike in spam volume.'"

5 of 135 comments (clear)

  1. Stronger malware by eviloverlordx · · Score: 5, Insightful

    It just means that, in a few years, all of the malware will be significantly harder to kill. All of the weaker 'species' will have been driven to extinction (via changes in coding). It had to happen eventually. We may even see 'anti-viral resistant' strains.

    --
    'Loose' is when your pants are three sizes too big. 'Lose' is when you misuse 'loose'.
    1. Re:Stronger malware by morgan_greywolf · · Score: 5, Funny

      No way. Malware is made by an Intelligent Creator. It is what it is. Intelligent Malware Design is just as good a theory as Malware Evolution.

      --
      My blog
  2. A New Variation of Life... by __aaclcg7560 · · Score: 5, Funny

    So is there going to be a screen saver that will show the good and bad malware attacking each other as the computer keeps waving a white flag?

  3. If they'd just fix each other... by queenb**ch · · Score: 5, Funny

    Will someone please write a worm that 1) turns Windows Update on, 2) turns the Windows Firewall on, 3) turns off the keyboard & mouse ports for Windows 3.1, 95, 98, and ME machines thus forcing the retarded end users running on these platforms to upgrade, 4) installs ClamWIN and scans the hard drive, 5) installs SpyBot Search & Destroy and scans the hard drive, and 6) administers an electric shock to the aforementioned retarded end user for not taking care of this themselves?

    If your dog was running around the neighborhood barking at people and biting them, they'd make you do something about the dog. I don't see why your computer gets to the do the same thing on the internet with such impunity.

    2 cents,

    QueenB.

    --
    HDGary secures my bank :/
    1. Re:If they'd just fix each other... by kabocox · · Score: 5, Informative

      I've found somethings that you asked for, but not all. I did don't know how to string them all together. ClamWin, and SpyBot, both say that they'll run from a bootCD. I didn't find any easy to follow admin install instructions for them. Mainly everything else is some reg files. I didn't find anything on keyboard or mouse ports of earlier versions of windows. I also didn't find anything about how to shock users. In the spirit of open sourceness, I expect someone else to actually do the real work of building a self installing zip file of ClamWin & Spybot, setting your fav. reg. settings, and having all of them autorun after a shutdown -r. I know that "it should possible." I don't know enough windows scripting in order to do it.

      net stop wuauserv

      Start -> Run -> gpedit.msc -> Local Computer Policy -> Computer Configuration -> Administrative Templates -> Windows Components -> Windows Update -> Re-prompt for restart with scheduled installations. They hid it well but it's there :^)

      [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Wi ndows\WindowsUpdate\AU]
      "RebootRelaunchTimeoutEnabled"=dword:00000000
      "NoAutoRebootWithLoggedOnUsers"=dword:00000001

      HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Curr entVersion\Policies\Explorer
      NoDevMgrUpdate value to 0

      HKEY_LOCAL_MACHINE \ SOFTWARE \ Policies \ Microsoft \ WindowsFirewall

      Set these to "not configured"
      * Windows Firewall: Protect all network connections
      * Windows Firewall: Do not allow exceptions
      * Windows Firewall: Define program exceptions
      * Windows Firewall: Allow local program exceptions
      * Windows Firewall: Allow remote administration exception
      * Windows Firewall: Allow file and printer sharing exception
      * Windows Firewall: Allow ICMP exceptions
      * Windows Firewall: Allow Remote Desktop exception
      * Windows Firewall: Allow UPnP framework exception
      * Windows Firewall: Prohibit notifications
      * Windows Firewall: Allow logging
      * Windows Firewall: Prohibit unicast response to multicast or broadcast requests
      * Windows Firewall: Define port exceptions
      * Windows Firewall: Allow local port exceptions

      http://sourceforge.net/docman/display_doc.php?doci d=28367&group_id=105508

      Preparation

      Start by installing the latest version of ClamWin, and download the latest virus definitions. See the ClamWin manual for full details on how to do this. Note that, if you are going to create a CD, you will not be able to update the virus definitions without creating a new CD, since a CD is read-only.
      Copy Folders

      Create a working folder in a convenient location to hold the files that are to be copied onto CD/USB, eg C:\ClamWin-CD.
      In the working folder, create a folder named ClamWin.
      Copy the contents of the ClamWin program folder into C:\ClamWin-CD\ClamWin. By default, the ClamWin program folder is installed to C:\Program Files\ClamWin
      Create folders named log, db and quara