Slashdot Log In
New IM Worm On The Loose
Posted by
CmdrTaco
on Mon Oct 11, 2004 06:28 PM
from the head-for-the-hills dept.
from the head-for-the-hills dept.
elfarto writes "Techweb is
reporting that a new worm that spreads via Microsoft's instant messaging client
began badgering users Monday, several security firms said.
Dubbed Funner, the worm propagates by sending itself to all the contacts listed
in the user's copy of MSN Messenger, Microsoft's IM client.
There is an analysis on
Symantec Security Response Site; apparently the worm tries to download stuff
from www.78p.com and adds entries to the hosts
file pointing to more that 400 Chinese porn sites. The worm also sends itself to
the whole contact list as funny.exe so it requires the user interaction to
actually execute it. "
This discussion has been archived.
No new comments can be posted.
New IM Worm On The Loose
|
Log In/Create an Account
| Top
| 407 comments
(Spill at 50!) | Index Only
| Search Discussion
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
Re:Another reason to move to GAIM (Score:5, Informative)
(http://www.crfh.net/ | Last Journal: Tuesday November 14 2006, @02:47PM)
Re:Another reason to move to GAIM (Score:4, Informative)
(http://www.cafepress.com/lehk | Last Journal: Wednesday July 25, @12:50AM)
Re:Another reason to move to GAIM (Score:5, Funny)
(http://slashdot.org/ | Last Journal: Sunday July 29, @04:31PM)
Don't forget... (Score:5, Informative)
(http://tinyurl.com/88mfc)
FreeBSD [freebsd.org]
OpenBSD [openbsd.org]
NetBSD [netbsd.org]
DragonFlyBSD [dragonflybsd.org]
Re:Another reason to move to GAIM (Score:5, Informative)
(http://www.monroe.nu/)
Even better, set your little sister up with Linux and not have to worry about all the other crap funny.exe will do.
Re:Another reason to move to GAIM (Score:5, Funny)
(Last Journal: Sunday September 28 2003, @11:48AM)
it finds porn? (Score:5, Funny)
This will be successful..... (Score:3, Funny)
Geez, who cares. If a dumbass like me thinks that would be ridiculous, I'm sure everyone else in the world would think so too.
Re:This will be successful..... (Score:5, Insightful)
(http://mrsodaoverload.com/michael)
Users can be psychotic sometimes...!
Re:This will be successful..... (Score:5, Funny)
(http://www.noirchickenstudios.com/)
*sigh*
Re:This will be successful..... (Score:5, Insightful)
is it just me or is it my friends (Score:5, Funny)
Re:This will be successful..... (Score:5, Interesting)
The knowledge (or lack thereof) of the average computer user is the real reason that security is such an issue today.
Re:This will be successful..... (Score:5, Funny)
Re:This will be successful..... (Score:5, Insightful)
(Last Journal: Wednesday September 08 2004, @11:02AM)
That's like saying "All Linux users are elitist snobs", just because there's some jerks mixed in out there.
Re:This will be successful..... (Score:5, Insightful)
Not only are MSN users ignorant, most Joe and Josephine users are that ignorant *in general*.
I just spent 3 hours today cleaning up a machine that had upwards of 60 trojans and other malware on it. One of which was a keylogger. It was amazing that this machine ran at all.
Does the owner of said computer have any clue about how all this malware got there? Nope. He's got 3 kids, though, that all use the same computer. I
He is ignorant, in the truest sense of the word. He is also *typical* of most home computer owners. People these days expect their machines to simply work, like toasters, because the interface hides the real complexity. I have been trying to educate him, and it's been a battle.
But regardless of that, MSFT has never done any User Education itself. Bill prefers it that way, and that's a shame. Keeping the users ignorant allows MSFT to Blame The User when it comes to exploits (You Failed to Upgrade!), allows them to force DRM down their throats, and basically allows the company to run roughshod over its customer base, without complaints.
So yes, MS users are ignorant. They simply do not know better, and their precious vendor, Microsoft, is aiding and abetting this ignorance.
So what are *you* doing to educate your users?
--
BMO
Time to switch, perhaps? (Score:5, Insightful)
Re:Time to switch, perhaps? (Score:4, Informative)
Woohoo! (Score:5, Funny)
Re:Woohoo! (Score:5, Funny)
(http://www.alexkrupp.com/)
why MSN is having trouble? (Score:4, Interesting)
Re:why MSN is having trouble? (Score:5, Funny)
No, that's normal.
Impact? (Score:5, Informative)
(http://www.thoughtbug.com/ | Last Journal: Thursday September 27, @05:52PM)
Re:Impact? (Score:5, Interesting)
(http://inglorion.net/ | Last Journal: Thursday October 06 2005, @07:17AM)
Well, here's another argument against "Microsoft software gets broken into more, because it is more widely deployed". (Besides Apache vs. It Isn't Secure.)
Dammit (Score:5, Funny)
LUA (Score:4, Insightful)
Re:LUA (Score:5, Insightful)
Seriously, they would have 19 gazillion support calls the next day.
Re:LUA (Score:5, Funny)
Frequently, these start up a service when they run. It would be very hard to make these work as non-admin.
Personally, the first thing I do when I find a game like this is download a no-cd patch/crack. Then I can run it unprivileged.
There are exceptions; the last icq client I tried won't even run as 'power user' and must be run as administrator.
The developers of this sort of rubbish need electric shocks applied to their genitalia every time someone gets infected through their crap application.
Re:LUA (Score:5, Insightful)
(http://inglorion.net/ | Last Journal: Thursday October 06 2005, @07:17AM)
And don't think loggin out and back in would solve the problem; you just install in the user's logon scripts rather than the system boot scripts.
Apart from protecting other users' files, non-privileged accounts don't add a whole lot of security. And on Windows, it hardly works anyway. There are many things that should work for regular accounts but don't, and other things that shouldn't but do.
Worms... (Score:5, Insightful)
d'oh (Score:5, Funny)
First good reason i hear to switch to Windows.
worm isnt going to do much damage (Score:5, Funny)
(http://www.fuckedregime.com/)
www.78p.com has address 1.10.5.89
A step back (Score:5, Funny)
(Last Journal: Monday May 30 2005, @01:21PM)
Re:Obligitory windoze comment... (Score:5, Interesting)
The fact is, Windows has a solid, well implemented, priviledge system. The second fact is that they gave this up in favor of app compatiblity (crappy programs that expect to write to the windows directory just to run, versus to user directories) and ease of use. This is biting them in the ass, and they are working on getting people away from running as Administrators. Just not as heavy a push as I'd like.
Re:Obligitory windoze comment... (Score:5, Informative)
The kind of people who would execute this file, are the same kind of people who wouldn't know how to give some file execute permissions if they were running a Unix-based workstation (probably even OS X).
Re:400 porn sites? (Score:5, Funny)
Trolling... (Score:5, Funny)
And they don't run as Admin anyway, so the worm couldn't even infect them if they did click it...
And Microsoft will surely release a prompt fix to address this issue...
So I don't see what the problem is here. :-)
Clever! (Score:5, Funny)
Ohhhh... I see the plan... we slashdot 78p.com, thus limiting the 'worm's damage!
Good thinking, guys!
Just [78p.com] doing [78p.com] my [78p.com] part. [78p.com] ;) [78p.com]
Worm name in article is wrong (Score:5, Funny)
(http://ratetheoffers.com/)
------------------
Rate free iPod offers: RateTheOffers.com [ratetheoffers.com]
(Flat screens and Desktop PCs too)
Symantec Analysis (Score:3, Informative)
(http://www.red82.com/ | Last Journal: Monday April 19 2004, @11:00AM)
Other than that, not much info there, except it points out the obvious, that osX users are not affected, since this appears to be a Visual Basic bug.
If nothing else, the listing of some 940-odd asian porn sites on the Symantec page will be useful to someone...
You can be rich !! (Score:5, Funny)
China rewards porn snitches [slashdot.org]
1)run windows 2)get infected 3)receive list and fwd to the chineese authority 4)profit!!
MSN downtime (Score:3, Informative)
(Last Journal: Wednesday March 27 2002, @09:26PM)
Almost all of my contact list confirmed having the same problem.
Fact checking? (Score:5, Funny)
(http://www.ratcrow.com/)
How do they know that all 400 are porn sites? Did someone actually sit down and visit every one?
Also, are they hiring?
So much for natural selection (Score:5, Funny)
(Last Journal: Wednesday September 17 2003, @06:48PM)
One day, with a bit of luck, people opening attachments/files/emails/whatever like this will be considered much the same as people eating strange pieces of food that they find in the street.
For those in the support side of the field, remember that as long as there are stupid people (and there always will be) security vulnerabilities will always be a poor second cousin to humans. The bulk of your support calls won't come from clever little worms that capitalise on obscure security flaws in a product, they'll come as a result of idiots thinking that "nakedwoman.exe" is actually something they want to see.
Yet another reason we should embed cattle-prods into keyboards... "wow, some stranger sent me some naughty pictures of herself! Pity they're archived, I'll just double-click and let them extract themsel *zaaaaaaaap!!!*"
Suspicious... (Score:3, Insightful)
(http://num1fansoft.cjb.net/)
Hell (Score:5, Insightful)