Kama Sutra Worm Could Make For A Bad Friday

mikey1134 writes "CNN is running a story about the Kama Sutra worm, a virus that is coded to overwrite files of the (potentially thousands of) infected computers. They provide some background on this viral outbreak and warn users to protect themselves" From the article: "And even for home computer users who have never taken such precautions before, security experts say now would be a good time to back up your most important data, like financial information and family photographs, to CDs, DVDs, zip drives, or an external hard drive that you know is worm and virus free. Unlike a lot of malware that exploits vulnerabilities in the Windows operating system, there is no 'patch' that can be downloaded to ward off Kama Sutra."

Many Aliases and More Info

[eldavojohn (898314)]

For references, these are the enumeration names and where to go to make sure you have the latest anti-virus signature [mitre.org]. Remember, this variant will uninstall and delete most anti-virus software so it's important to recognize it before it goes active tomorrow. Most virus definition software refers to it as CME-24. This is important since this worm has many different names including Nyxem.E, BlackWorm, Grew and Mywife.E.

More on the worm [sans.org] and its permutations and statistics on spreading.

A very detailed analysis [lurhq.com] with all types of files that may be affected.

And, if it's worth anything to you, the Microsoft advisory [microsoft.com] which seems to tout that Windows Live Safety Center Beta [live.com] can protect against it. If you're in charge of computer security at your workplace, I would send out an e-mail instructing everyone to verify that they have the correct anti-virus definitions and to scan their computers before leaving tonight. Luckily, that's not my job where I work.

Re:Many Aliases and More Info

[cinnamon colbert (732724)]

like totally unhelpfull..I didnot understand a word of your post or the links

Surely, there is a simple answer to this question:
if i scan my hardrive tonighte with avg or macafee or norton, am i protected ?
where do i download the patch ?

if not, this surely demonstrates that the protection companies aint worth a tinkers damm

Re:Many Aliases and More Info

[rkrabath (742391)]

>> if i scan my hardrive tonighte with avg or macafee or norton, am i protected ?

Possibly yes, but also possibly not. This virus wil disable many common AV programs. My reccomendation would be to use a specialized scanner such as the one from f-secure: http://www.f-secure.com/v-descs/nyxem_e.shtml [f-secure.com]. I just used that one myself.

Re:Many Aliases and More Info

[xeoron (639412)]

I would think one of the best solutions (along with backing things up) is to turn the system clock back a few days, until a proven removal tool can be used.

Re:Many Aliases and More Info

[Inda (580031)]

I know you're only trying to help but to answer the GP's post again.

Probably yes. That's a big 99.9% yes...

Yes, the Worm tries to delete anti-virus program files. Yes, tries to stop anti-virus software running at reboot. But if it's managed to do that, there's no way you're scanning your PC tonight anyway.

Update your definitions and scan now. Inform everyone you know not to open email attachments they weren't expecting.

Which brings me to another point: Do people really get hit with these anymore? It won't make it though all the major webmail services. You haven't been able to open *.PIF or *.SCR files in Outlook for years now. You almost have to go out of your way to get infected by email worms these days.

Don't get caught up in the media hype. This isn't another Blaster.

Re:Many Aliases and More Info

[j-cloth (862412)]

McAfee DATs 4642 [mcafee.com] and higher will catch it.

Re:Many Aliases and More Info

[by Anonymous Coward]

Surely, there is a simple answer to this question:
if i scan my hardrive tonighte with avg or macafee or norton, am i protected ?
where do i download the patch ?

I just emailed it to you. Click on the attachment to open it.

Re:Many Aliases and More Info

[Phillup (317168)]

You might be right... but he is representative of the average user.

So, while you scorn his 133t skillz... the point (which you missed) is legitimate.

Re:Many Aliases and More Info

[jericho4.0 (565125)]

/. has changed markedly over the years, but still keeps it's technical orientation. This has become more obvious, IMO, since the emergence of digg.com, a site with lots of tech news, but very n00bish comments. How about we keep /. the way it is, instead of trying to dumb it down? The links provided contain lots of usefull info. You might not understand all of it, but you might learn something.

Re:Many Aliases and More Info

[hesiod (111176)]

> How about we keep /. the way it is, instead of trying to dumb it down?

Absolutely, and if you don't understand something, read the comments. Chances are pretty good someone else didn't understand either and asked. Or if that hasn't happened, post the question yourself. That's why the comments section is here!

Re:Many Aliases and More Info

[muszek (882567)]

[cut!] enumeration... [cut!] the latest anti-virus signature... [cut!] CME-24. ... [cut!] Nyxem.E, BlackWorm, Grew and Mywife.E.... [cut!] permutations ... [cut!] detailed analysis ... [cut!] advisory ... [cut!] Windows Live Safety Center Beta ... [cut!] security ... [cut!]

Nah, nobody needs that voodoo stuff. The virus only overwrites files of certain types. All you need to do is to turn off "show file extensions" option in Explorer to totally confuse the virus ;)

Sorry if I confused that option's name... I haven't touched a windows box in a while.

Obligatory Kama Sutra Comment

[sumi-manga (948999)]

Better back up that pr0n too! :P

More Obligatory Kama Sutra Jokes

[fishdan (569872)]

So I guess Kama Sutra could put some IT professionals in some awkward positions

As long as you don't

[IAAP (937607)]

end up fucking yourself.

Your computer...

[bondsbw (888959)]

... really should have more flexible security.

Write-once backups

[truthsearch (249536)]

The best backups are those written to only once. Burn to a write-once only CD or DVD. Don't back up to an external hard disk. As soon as you plug it in anything can happen, either from Windows itself or from malicious software (redundant, I guess).

In the old days we backed up to tape and flipped a switch so the tape couldn't be overwritten. Today it's burn-once disks. Don't trust anything but physical protections from disk writes.

Re:Write-once backups

[TubeSteak (669689)]

In the old days, we etched our words into stone tablets for safe keeping..

A destructive virus was when a sick person would start coughing so hard that they'd break tablets by knocking them over.

The cost of physical media was high & the write speed was slow. Back then, we went to a lot more effort to make sure that our backups stayed safe.

Re:Write-once backups

[by Anonymous Coward]

I remember those days. There was this guy called Moses who had received some seriously important data on top of some mountain. He goes down the mountain, and he breaks the tablets. He didn't make backups, so he had to go back to his client and ask for a new copy of the data. Very embarrasing.

That should serve as a warning to everyone; always make backups. Especially with important clients like that.

Re:Write-once backups

[charlesnw (843045)]

You evidently don't have a lot of data to backup. My nightly backups are almost half a terabyte. If I didn't reuse media, I would have a very hard time getting my budget approved. Media isn't cheap. 100 tapes is $10,000.00. Write once is nice but doesn't work in real life. Unless you have small amounts of data that fit on one TAPE or DVD. And if you have to store your backups (we have to store offsite for 7 years) you would be paying 2 arms and 3 legs in storage and handling fees.

Re:Write-once backups

[bored (40072)]

My nightly backups are almost half a terabyte..Media isn't cheap. 100 tapes is $10,000.00

What I was saying was that LTO-3 stores 400G uncompressed, the tapes are less than $70 and the drives are less than $2500. Sounds like its time for you to buy a new tape setup.

Oh yes, this

[voice_of_all_reason (926702)]

This is the virus that MS has a patch from their fancy new Remote System Control program, right? Simply agree to download and blindly run any code they decide to send, let 'em take a peek at what you're running from time to time, and send regular status reports to the nice windows home base -- and then, we'll protect you from the nasty viruses!

And remember, kids... that's a nice computer. Would be a shame if something were to "happen" to it, you know what I mean?

Re:Oh yes, this

[jayhawk88 (160512)]

And remember, kids... that's a nice computer. Would be a shame if something were to "happen" to it, you know what I mean?

I'm sorry, our records indicate that this joke was used no less than 17 times in yesterday's thread [slashdot.org] about this same topic. You are in violation of the Stale Internet Joke Act of 2004. Please refrain from any and all AYBABTU references and report to UseNet for remedial training immediately.

Oh leave off it

[Sycraft-fu (314770)]

There's no patch because it's not a vulnerability, it's a virus. The only thing you can patch is the users that still won't follow directions and not open executable attachments. The OS is working as intended when it executes code you ask it to, which is how this virus gets on.

This "OMG MS won't patch t3h systems!!!11" stuff on Slashdot is getting old. No, they won't patch it because there's nothing to patch. Duh. They have decided to add it to the malicious software tool, which is a mini virus scanner akin to Stinger from Mcaffee, which scans for a limited subset of viruses, but that's not a patch. Windows OneCare, which is NOT a remote control system by the way, does find it because, well, it's a virus scanner just like any other. It catches it just like AVG, F-Secure, Norton, and so on, which is to be expected as it's a competitor.

So let's leave off the bullshit ok? There are two easy methods to prevent this from hurting your system:

1) Don't run random programs that some with e-mails. If you use Outlook Express, it'll even tell you not to (twice).

2) Get a virus scanner. Doesn't need to be MS's, there are many good ones out there. I recommend AVG, it's fast and free.

Re:Oh leave off it

[sootman (158191)]

"Don't run random programs that some with e-mails. If you use Outlook Express, it'll even tell you not to (twice)."

Super. That will take care of it. </sarcasm>

I use OWA and this is next to every single attachment: "Attachments may contain viruses that are harmful to your computer." Gee, thanks. When users see that next to every single word doc, PDF, and JPEG they get on a daily basis, they start ignoring it. If everything is a threat, nothing is a threat.

Re:The OS is working as intended -- vulnerably

[Sycraft-fu (314770)]

They can't hide that they are apps. Windows will warn you that it's an app, and tell you not to run it. You don't need to run as an admin to run Windows. We have hundreds of computers in the department which users do not have admin access on. People run as admin because they are lazy. Besides, if your e-mail client saying "Warning, this could be a virus don't run it" and then your OS saying "Warning this oculd be a virus don't run it" isn't enough, changing the OK to a password field isn't going to do any g

But but but we want a patch!!!

[Siberwulf (921893)]

"Unlike a lot of malware that exploits vulnerabilities in the Windows operating system, there is no 'patch' that can be downloaded to ward off Kama Sutra."

Half the articles i read yesterday about this said that the public was being screwed over becuase MS wouldn't release a patch.

The only patch for stupid is a swift boot in the ass.

Re:But but but we want a patch!!!

[plover (150551)]

Actually, this virus might BE the "patch" for stupidity.

"Hey, what happened to all my documents?"

"You opened a pr0n attachment in your email, you just got what you deserved."

"Boy, I'll never do that again!"

So, if these idiots are capable of any learning at all, this might work out to be a good learning experience for them. And if they're not, well, hey -- it's not my problem they're stupid.

Patch? How about a brain patch!

[Sporkinum (655143)]

Unlike a lot of malware that exploits vulnerabilities in the Windows operating system, there is no 'patch' that can be downloaded to ward off Kama Sutra.

How about a stupidty patch for opening up an attachment like the one described.

Don't I wish

[Sycraft-fu (314770)]

Here's my idea:

We setup a room. The door to the room says, in every language "Danger! Do not enter". Inside they'll be a cage you need to open, again with keep out warnings. Inside the cage will be a button that says "Warning: Do not push the button, death will result!". If you push the button, you die. We come in once a week or so and clean out the body.

My guess is any person likely to push the button is also the kind that'll open random attachments despite being told not to by us, the OS, their virus scanner, etc.

Problem solved :D

i have a patch

[tehwebguy (860335)]

just turn your computer off before midnight, and leave it off until saturday.

Re:i have a patch

[xlyz (695304)]

you can do better:

turn you pc to an other os and leave it on tomorrow as well

Re:i have a patch

[The Good Reverend (84440)]

Right, because that's fantastic advice for the type of people who click on unknown attachments in their emails...

Congrats, you use Linux. It's be great if more people did, perhaps. But now you're just jerking yourself off, and it doesn't seem particularly helpful.

Zip drives?

[Dr. Sp0ng (24354)]

...to CDs, DVDs, zip drives, ...

What is this, 1996?

Strange...

[casualsax3 (875131)]

Anyway I like how virus names are slowly getting edgier. Kama Sutra is a good one, but it'll be great fun when someone names a virus the Angry Dragon, Cleavland Steamer, or the Dirty Sanchez. I eagerly await the day when the words "Rusty Trombone hits America hard" grace CNN's frontpage :)

Even better

[databyss (586137)]

CasualSax's Rusty Trombone pounds the US in the IS.

Hmm

[voice_of_all_reason (926702)]

As bad as this day? http://images.amazon.com/images/P/0689711735.01._S CLZZZZZZZ_.jpg [amazon.com]

//mah favorite book

Clue About How To Detect Whether You're Infected

[Fleetie (603229)]

This URL would seem to provide some hints about how to check whether you're infected.
It mentions some registry keys that the worm sets up.

http://www.sophos.com/virusinfo/analyses/w32nyxemd .html [sophos.com]

Go Ask Alice

[RobertB-DC (622190)]

From TFA:
"So while you might think it is coming from cousin Alice, most likely cousin Alice is not going to send you something that says 'Hey look at these pictures with naked people.' So that should be your first clue that a virus is propagating and you'd be well served to call cousin Alice to let her know that she is [unknowingly] sending out this type of e-mail," Sergile said.

Mr. Sergile, you obviously haven't met my cousin Alice [alicecooper.com].

Re:Go Ask Alice

[Kiaser Zohsay (20134)]

The really sad part is that it probably wasn't even cousin Alice who sent it, it was someone else who had both you and cousin Alice in their address book.

It could be worse. Alice could be your dad [visit4info.com].

Searches Network Shares

[ObsessiveMathsFreak (773371)]

This one will be more damaging than people think.

A lot of SMEs uses unsecured and passwordless network shares for sharing company data. Data that is stored in, you guessed it, *.doc *.xls, etc, etc files. This virus looks for shared drives such as this and will corrupt the files on them tomorrow.

If only one PC in the company is effected, I can see a whole lot of sore heads tomorrow at lunchtime.

I guess I should have paid more attention to this one.

Re:Searches Network Shares

[Feebleminded_Genius (950911)]

Agreed. I've been chasing this down on our corporate network all week.

I installed this virus on a test network last night. It was ugly to say the least. The test network was comprised of 5 clients, 1 DC, and 1 file server. When I ran the email attachment on a client, it immediately froze, consistent with the description on F-Secure. Upon rebooting with monitoring on, it launched numerous processes, and disabled Symantec immediately. Within 4 hours it had infected the other 4 clients & the file server.

We then flipped the switch on the DC & set the date to 2/3/06. Update.exe launched half an hour after login, and within 4 hours all .docs, .xls, .mdb files etc were corrupt on the local machines and the file servers.

Note that this test was performed with out-of-date virus defs as a test.

Here's an idea for those in a corporate environment. Create a software restriction policy for the executables associated with the virus:
%systemroot%\system32\scanregw.exe
%systemroot%\system32\update.exe
winzip quick pick.exe
winzip_tmp.exe

We did this in our test environment and it halted the virus completely.

Anyone else calling in sick tomorrow?

[digitaldc (879047)]

I feel a sudden illness coming on, could be a virus.

Re:Anyone else calling in sick tomorrow?

[gbrandt (113294)]

It's worms.

CME-24 aliases, information, and removal tools

[Futurepower(R) (558542)]

Here's how to know the difference between a money-making press release, and an honest story: The press release says "Fear, fear, fear!!!"

The honest story gives you links to tools for eliminating the threat: You can run this tool: W32.Blackmal@mm Removal Tool [symantec.com], which apparently removes all variants of the worm.

Here are manual instructions: WORM_GREW.A, Also known as: CME-24 [trendmicro.com]

Here is the list of names of the CME-24 worm, and links to removal methods: CME-24 aliases, information, and removal tools [mitre.org].

Ok guys, seriously there's an easy answer.

[jonfields (643711)]

Step 1: Go into Date and Time properties Step 2: Click on Internet Time tab Step 3: Uncheck Automatically Synchronize Step 4: Click on Date & Time tab Step 5: Change the date to the 4th (saturday) Step 6: Click OK Step 7: Wait until it really is saturday and turn automatically synchronize back on. I'd reccomend this for everyone, whether you think you have it or not, just to be on the safe side.

Am I safe?

[Arandir (19206)]

I'm using FreeBSD, am I safe? I think I am, but with all the panic swirling around over this issue, I'm not sure. Some guy just ran past my cubicle screaming, "no one is safe!"

Re:Will be a good thing

[meringuoid (568297)]

I'm sorry? It won't be super destructive? May I ask what you define as a super destructive virus? Overwrting the contents of all MS Office documents (not just deleting them) is extremly devestating.

Sure. But I reckon gradually corrupting small parts of them is still worse. You might only realise you were infected months later, when the quarterly financial figures come out totally whacked, and you'll spend the rest of forever in the company of accountants and auditors trying to track down the correct figures.

Fragging out a file all at once? Then the victim realises something's up, gets the machine fixed, loses some work. Imperceptibly corrupting the file? Victim keeps spreading the virus, and every version of every file he works on is suddenly untrustworthy...

Re:No patch!!!! WTF

[InsaneGeek (175763)]

I wouldn't call it a Microsoft insecurity issue, but a stupid user issue. The user has to install it for it to work, the user actually has to be involved and allow it onto their box. The same type issue can be had for a Linux box and you don't even have to be a root user to be affected; someone emails you unknown app and like these windows dumbasses you run it can wack all of the Openoffice documents you have been using to write your disertation for the past year is gone.

A stupid user is stupid user, the article summed it pretty well: "Unfortunately, there is no way to patch user ignorance, and the way this virus propagates is through user ignorance,"

Re:Great reporting, CNN

[HaydnH (877214)]

"As much as I appreciate the warning, hints on HOW to know if you're infected would have certainly helped."

As much as I appreciate your comment, hints on HOW to know if you're infected would have certainly helped.

So I don't get the same response to this comment, here's some links to Nyxem/Karma Sutra/MyWife (Whatever you wanna call it) removal:

- Symantec [symantec.com]
- McAffee [nai.com]

Haydn.

Re:SAMBA shares affected?

[NetCow (117556)]

It will most certainly affect any writeable permanent redirected shares, AKA mapped drives, since the whole point of mapped drives is to create something that looks like a regular local storage volume.
It will *probably* walk the local network and affect nay shares it can access.
But - why take the chance? Always assume it will affect anything it could possibly write to.