Slashdot Mirror
After 7 Years, MyDoom Worm Is Still Spreading
An anonymous reader writes "Researchers at Sophos have revealed that the MyDoom worm, which spread via email and launched denial-of-service attacks against websites belonging to SCO and Microsoft, is still spreading on the internet after more than seven years in existence. The firm suggests, tongue-in-cheek, that it would be nice if computer users updated their anti-virus software at least once every 5 years to combat the malware threat."
Hello dear christian friend,
In the year of 2004 it is with great pleasure that I leave to you the sum ...
But if you got a MyDoom message in any modern software you'd get tons of warnings, and many e-mail programs would strip the attached executable as a matter of policy.
Sure it's not XP mode?
I don't run antivirus software in the VM because the VM almost is never up, but I wonder about people using it for significant amounts of time on a non-firewalled system. XP versions before SP1 would get root'd by simply having internet access.
Yes, AND they can get off my bloody lawn as well, before I set the dogs on them.
Gentoo Linux - another day, another USE flag.
I'll support that.
Right after we require a license to have children.
That would fix alot more stupid thanjust a computer worm problem.
The only thing that comes to mind is 'PEBKAC'.
nice.
Get a web developer
Is this really any surprise to anyone? People still believe that Bill Gates is going to pay you for forwarding email. Most attacks (malware, trojans, viruses, etc.) feed on the ignorance of the average person. It's sad really, but I don't expect anything different 27 years later, much less 7.
I hear from users and fanboys that Win7 is much more hardened than say WinXP
So my question is does this old virus still run on Win7?
If you actively run it and give it permission, yes. Since you mention fanboys, the Mac variety always claim malware doesn't count if users have to do that. Compared to XP it helps that Win7 have UAC, but the best defense against PEBKAC malware like this is running antimalware software like Security Essentials, which you also can do on XP.
If you really were interested, there is a lot of information out there about the security differences between XP and Windows 7, they are quite extensive (ASLR, DEP, UAC, improved firewall (with multiple active profiles), Windows Service Hardening, Protected Mode browser, etc.)
Maybe people should have to register their PC before they connect it to the Internet?? Maybe people should have to get a license to use a PC on the Internet? It might reduce the carnage on our roads ^H^H^H^H^H^H^ Internet....
Excuse me while I press my brown uniform and shine my jackboots, the DRM people are making me work overtime again :)
There ain't no such thing as proprietary standards only proprietary formats. Standards are by definition open.
Or alternatively, not have a virus checker at all as it slows down PCs, and misdiagnoses all the time (I don't need it deleting files which I know are NOT a problem).
Just be careful what sites you visit, do backups (using SyncBack of course) and a system restore will usually solve minor problems.
Why OpalCalc is the best Windows calc
If you really want to get people to run virus scanners (without making the scanner a virus itself) you'll have to make it beneficial to the individual. Create some really fun game and buried in the EULA mention that the program does a virus sweep each time it launches.
Either that or fight fire with fire.
No sig for you. YOU GET NO SIG!
About the users :)
"The likes of Facebook and WhatsApp are free to those whose privacy is of zero value."
Now this is a ridiculous description: "infected computers as part of a civil war between different factions of the Linux community."
"It is our choices, Harry, that show what we truly are, far more than our abilities." -- Prof. Dumbledore
Any malware that gets executed by the user and granted privileges runs on any system that the executable format it is in can run on. That's true for Windows 95, Windows 7, MacOS of any version and Linux of any flavor.
No system can defend against the stupidity of its owner. Unless the system is actually "protected" from its owner. For further reading, look up DRM and TCPA.
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
I'm not really happy with the idea of handing the government even MORE say of what I may do with my computer and what I may not, it's not like they already take more than enough liberties (pun intended) in this matter.
But how about a radical idea: Make people responsible for what their computers do. Make them legally liable if their machines spew out spam and participate in DDoSs, at least if a reasonable amount of precaution has been taken. I'm aware that you cannot easily defend against all threats out there, and I am willing to accept that people should not be required to get an IT degree just to be allowed to join the internet, but I think it's not asking too much to keep your system up to date and patched (especially considering how pretty much every current system does it automatically) and at least TRY to protect themselves against malware. Use whatever AV suite and I'm already happy. You took reasonable precautions, as much as could be expected from a computer illiterate, you're off the hook. You decided to click away every warning your system presented to you, then take responsibility for your stupidity.
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
Actually, if you're a multi million dollar company you might not be able to upgrade from IE6. I know of such a company. Their main application that the whole company hangs on is written for IE6, with IE7+ unable to render it sensibly.
And yes, we're talking about a friggin' HUGE company here. Think Sony. Just big.
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
Just because you're a giant, doesn't mean your brain disease isn't serious.
But the thing about software, is that it costs the same to fix no matter how many people use it. The surgeon still costs the same.
the computer user runs untrusted code that was sent to them by strangers
Then how should code become trusted?
Often times they "have to install this special video codec to watch [insert celebrity name here] boobs". Not only do they install this "codec", they give it admin rights.
As I understand it, codec installers require the user to elevate because operating systems' multimedia frameworks offer no easy way to install a codec to a single user's account. Instead, codecs must be installed to the system for all users.
the 3 applications they use (internet, mail, some word processor) [...] require at best 10% of the CPU's capacity.
If by "internet" you mean the web, then I've seen sites using Adobe Flash or HTML5 new features use far more than 10% of a core.
Security updates work fine, even if the copy of XP is pirated. Either way, anti wirus / malware software is free.
So, do you have a license to sell hair tonic to bald eagles in Omaha Nebraska?
How about we actually hunt down and prosecute the people who release these viruses and use them to spam and DDOS
It is EXTREMELY dangerous to start attaching criminal responsibility to people who had no criminal intent and took no criminal action due to their victimization by (harder to catch) criminals. Eventually, the police would just stop trying to get the actual criminals (too hard) and would focus exclusively on the easy to catch victims.
If someone buys a computer with "anti virus" software on it that turns out to be fake, should they have known better? How about if it only cost $50 for the AV in a world where it usually costs $500 because "your freedom is too valuable to risk"?
An, of course, once the principle is established, overeager DAs will be only too happy to expand it to cover practically anything you might own. How much care is 'reasonable' to make sure your kid's baseball bat isn't used to beat someone to death?
Yes, in an area where for all practical purposes there is no law enforcement, people should use more caution. No, they don't deserve criminal prosecution if criminals victimize them. I'd rather law enforcement concentrate their efforts on the actual criminals.
Unfortunately, unlike with hookers, you don't know if the one spamming is the one who wants to sell. Under your law, if I want to put you out of business, all I had to do is to send out spam advertising your product.
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
Because the internet is an international world where national borders mean jack, while that's not the case with law enforcement. The people writing and operating malware rarely sit in the US or France. They usually hail from a country the name of which ends in -stan, where law enforcement gets a good chuckle out of it if you ask them to prosecute someone spamming or phishing in your country. They have real crimes to prosecute, and they don't give a rat's behind about your problems. I mean, do you care about theirs?
It's also not criminalizing the victim, it's criminalizing someone who is criminally careless. I don't know about your country, but in mine it is considered "incitement to crime" if you leave your car keys in your unlocked car or your entrance ajar while you're not home, and both can be fined (not to mention that your insurance will certainly not cover any losses). Why should criminal neglect be unpunishable in the vicinity of computers? Why is every law suddenly completely different when you add "done with computers"?
It's common sense to lock your car and house when you leave it. It's common sense not to let anyone in your home. It's common sense to not believe someone who offers to give you some money for nothing. Why is everything different when it comes to computers?
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
True, but "it's working, isn't it? Then why change it?"
That was, in a nutshell, the answer I got. And that's also the reason why changes are unlikely to happen any time soon. It's working. Changing it costs at least 6, more likely 7 digits. No chance that you could get that kind of money to change something that "is working".
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
2004? Pfft. My IDS is still showing probes from the Blaster Worm, that was 2003.
Poor means hoping the toothache goes away.
I think some ppl should make a mimic my doom virus that simple informs the ppl
they need to patch and until then their tcp/ip files have been removed.
Gets them off the network and educates them.
google "32 trillion offshore needs IRS attention"
Update once every 5 years. Got it. Cheers.
If the U.S. can start extradition for a college kid in the U.K. over a few LINKS to allegedly pirated material, we can find a way to get at massive crime syndicates in other countries attacking millions of citizens here. If some other country won't curb their criminals (at least to the point of keeping their crimes within their own borders), cut them off (or filter them heavily) until they change their minds.
The Senate can't seem to keep their machines secured, more than one police department has failed as well (and much more seriously than accidentally relaying some spam). The DoD and even the CIA have had their failures as well. Multi-billion dollar corporations have plenty of failures there. Why should Aunt Tilly with her much more limited resources (including access to expert advice) be expected to do any better?
Next problem is who decides what is adequate? Must run anti-virus software? Where will I get that for my Linux, *BSD, or experimental MyOS (and why should I)? How about for Minix? If you decide to make exceptions, guess what major OS vendors will spend gadzillions in lobbying dollars to get their OS exempted and make sure *BSD and Linux are not.
There is also a big difference between a misdemeanor fine for failing to adequately secure a system (presuming agreement can be reached on what is adequate and it can be expressed in reasonably simple terms) and being held responsible for whatever it does when infected.
This virus has accomplished what no one else has managed on the Windows Platform. Backward Compatibility. 7 years and running!
Just create a modified MyDoom to format the machines after one month of being infected, you will find less machines getting infected after that.
Well, if there was some kind of interest, then maybe. Sadly, there is no RIAA behind the anti-spam movement.
And you're right, taking full blame for the fallout isn't necessary, a fine in the vicinity of 100-500 bucks will keep people keenly interested enough to enable some brain cells before clicking every dancing monkey.
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
Well if they are in Bumfuckistan nobody is gonna care if we just kill the pricks then, are they? These guys are scum, they cause billions in damages and lost hours, as a friend in the state crime lab has told me some are even using their infections to sell CP and not have it on their personal machines. these are true scum of the earth and frankly shouldn't be treated any nicer than we treat the mob or any other criminal org.
So take them out. If the country refuses to do shit, well there are plenty of groups like Blackwater that are happy to do dirty jobs for a fee. follow the money, find these rats in their holes and take them out. I bet a few high profile "actions" on a few of these scum might make them think twice about how much protection they can get by being in bumfuckistan. Let me put it this way: Would we put up with this shit if a country was spreading this much destruction and misery using non cyber means? Hell even the worst terrorist countries don't cause as much monetary damage as a single one of these fast spreading worms!
ACs don't waste your time replying, your posts are never seen by me.
If there is no real interest, the only thing a law could do is permit the police and crooks( politicians if you prefer) to "do something" about the problem by persecuting the innocent and spending less resources than ever on the actual problem. Meanwhile, a zillion PCs all around the world will make sure the spam doesn't abate even slightly.
If there is adequate interest, they should go after the criminal organizations behind the bot armies.
Dear friend,
stupidity cannot be made illegal unless prisons can be made the size of countries and countries the size of prisons.
As per your example: if you leave your car or your home open and you are robbed, you don't have any criminal or civil responsibility. Unless you are prepared to visit your mother in prison, don't say such stupid nonsense.
Talk for your country. In mine, leaving your car keys in your unlocked car means trouble. Usually handled by a fine. Unless the car actually gets stolen and used in a crime, then you're actually liable for facilitation
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
I think some ppl should make a mimic my doom virus that simple informs the ppl they need to patch and until then their tcp/ip files have been removed.
Gets them off the network and educates them.
I think most users would find it hard to patch their system if they no longer have network access to do it.