Please create an account to participate in the Slashdot moderation system

 



Forgot your password?
typodupeerror
×
Security

Latest WinWorm Spreads Via ICQ And Outlook 598

mgooderum was among the many to write in about yet another snippet of malice making the Windows desktop rounds: "The latest email virus -- 'Goner' -- is apparently running around this morning (AP news story on Iwon here - no login needed). The virus is a typical worm that spreads via attachments and user's address books. It appears as a message with an attachment that starts: 'How are you ? When I saw this screen saver I immediately thought about you...' Goner is apparently non-destructive other than the normal DoS issues with the load from it forwarding itself everywhere. What's moderately unique are two features. One is its ability to replicate via ICQ as well as the usual Outlook and Outlook Express. Two is its small size -- it has a packed form that is only 159 bytes. Symantec has details here; McAfee has details here." Update: 12/04 21:57 GMT by T : That should read 159 kilobytes. And as many posters have pointed out, "destructive" is in the eye of the beholder.
This discussion has been archived. No new comments can be posted.

Latest WinWorm Spreads Via ICQ And Outlook

Comments Filter:
  • by javaaddikt ( 385701 ) on Tuesday December 04, 2001 @05:37PM (#2656001)
    considering I've received 20 virus-laden emails through my @home account in a matter of days.
  • has already sent every one of my fellow employees all over the globe 27 copies of this thing.

    It's been going on for over two hours now. I can't help but wonder if he's still over there trying to run that damn .scr.

    Thanks, boss.
  • by Anonymous Coward on Tuesday December 04, 2001 @05:40PM (#2656037)
    Didn't everyone get the memo that opening attachments is a really dumb idea? I'm attaching the original message:

    &ltAttachment: Don't_Open_Attachments.eml.vbs&gt
  • Pure Wisdom (Score:5, Funny)

    by Phartx2 ( 79490 ) on Tuesday December 04, 2001 @05:40PM (#2656040)
    I just got the warning message from my school's network goons. In a move of administrative widsom at its finest, it mentioned:

    "The Bearcat Online email system is now blocking all messages with "Hi" as the subject."
  • by sterno ( 16320 ) on Tuesday December 04, 2001 @05:40PM (#2656041) Homepage
    Until Linux can spread worms as well as Outlook, Linux will never be accepted as a true desktop replacement!
  • by rkent ( 73434 ) <rkent@post.ha r v a r d . edu> on Tuesday December 04, 2001 @05:43PM (#2656084)
    Well, since McAfee and Symantec are reporting it, I guess this is not a first draft of magic lantern... unless they issue another press release in 45 minutes saying "um... nevermind, there is no 'Goner' worm."
  • by tswinzig ( 210999 ) on Tuesday December 04, 2001 @05:48PM (#2656121) Journal
    ...I was in a harry.
  • by heliocentric ( 74613 ) on Tuesday December 04, 2001 @05:49PM (#2656130) Homepage Journal
    WTF does "moderately unique" mean?

    I consider myself moderately unique in that my shirt size is an extra medium. I don't know many other people who take an extra medium, but if the shirt companies make 'em then I can't be fully unique.

    Either something is unique or it's not, by crikey! Soon we'll have things described as "marginally special"

    Well, at the local food store the manager often has things that are getting old on special... oh, you were talking about marginally...

    or "slightly dead."

    Ever see the Princess Bride? Wesley was not all dead when they took him to Miracle Max's....
  • by Mdog ( 25508 ) on Tuesday December 04, 2001 @05:55PM (#2656176) Homepage
    I'd still consider it non-destructive. It is only trying to keep itself alive, not destroy "unrealted" parts of your system.
  • by mblase ( 200735 ) on Tuesday December 04, 2001 @05:57PM (#2656189)
    Great -- someone's finally figured out that they can create a Trojan horse that not only digs a back door into your system, but silently kills off the guards at the front as well.

    Next thing we know they'll be rewriting Microsoft's system auto-updater to download even more viral code into your system. Won't that be nice?
  • by Anonymous Coward on Tuesday December 04, 2001 @06:04PM (#2656257)
    I'll bet! Steve Gibson! Could write one in 100% PURE ASSEMBLY! and have it smaller than that!
  • by moof1138 ( 215921 ) on Tuesday December 04, 2001 @06:14PM (#2656327)
    I would like to see Gartner condemn the use of ICQ and ScreenSavers, recommending IRC and turning off displays instead.
  • by Goner ( 5704 ) <nutate&hotmail,com> on Tuesday December 04, 2001 @06:18PM (#2656361) Homepage

    I am ashamed that anyone would intentionally use my Slashdot account name to bolster the popularity and reputation of their sick virus. I'm sure the hackers [adequacy.org] who created this monstrosity were well versed in such hacker tools as Bonzi Buddy [bonzi.com] and Lunix [lunix.org]. If they think I would come out and support such a destructive screen saver they are very, very wrong. If God wanted toasters to fly [macworld.com], he would have given them wings.

    So, you hackers, where ever you are, Goner (of Slashdot lore) does not approve!

  • by CoolVibe ( 11466 ) on Tuesday December 04, 2001 @06:26PM (#2656427) Journal
    I can vouch that we have tried at my office ... REPEATEDLY .... to do just that. Some users just don't learn. After many attempts and incidents, they continue to open and execute every darn thing they are sent. These are usually the same people who send out all the "cute little utilities" that will run supposedly humorous animations and whatever. Sure, the next step would be some sort of administrative control/intervention, but as expected .. management (non-IT dept) is more interested in keeping people happy than in properly run systems. Our hands our tied.

    That's why the LART was invented. If you can't get sense into 'em, beat it into 'em.

    Yes, I actually kicked a user off the network one time because he already gotten _three_ warnings from me. And yet he still opened untrusted attachements.

    *clicketyclick* no more DHCP lease, blocked by MAC address. His e-mail was directed to a temporary mailbox (so he couldn't get it from someone else's machine)

    He never did it again. Good luser. After a few days I couldn't stand his whimpering and copied his mail back and reactivated his lease. Now he listened and behaved. Actually, it had a more positive effect: that story went around the office, and they now think twice before opening something they get from someone they don't know. Heck, some even switched from OutLook to something else (I've seen copies of Eudora and filled up Netscape Mail folders appearing on the workstations all of a sudden).

    Sometimes you have to make it smart a little before they listen.

  • by Anonymous Coward on Tuesday December 04, 2001 @06:27PM (#2656440)
    I share an office with two other developers. One of the two is almost always silent. So I knew something was up when I hear: "Hmmm. Hmmmmm? Uh, guys." For him, this was a novel's worth of communication. I glanced over at his display, which showed an open Outlook *filled* with messages that read "Hi!" for the subject. (Very) shortly afterwards, company-wide email (an exchange server) was completely trashed.
  • by sharkey ( 16670 ) on Tuesday December 04, 2001 @06:42PM (#2656550)
    I'll send you the bill...

    Shouldn't that be, "I send you this bill to ask your repair"?
  • by sharkey ( 16670 ) on Tuesday December 04, 2001 @06:46PM (#2656571)
    The silouhette of Darth Vader in the icon is a nice touch, to my way of thinking.
  • by gosand ( 234100 ) on Tuesday December 04, 2001 @06:47PM (#2656580)
    I got an email (as did everyone else) from someone in the company who gave detailed instructions on how to use the "Rule Wizard" (first clue) to delete these emails permanently upon receiving them.

    The problem? The steps outlined how to check the subject line for the word "hi" and permanently delete it and the message flag.

    I tested this out, and Outlook isn't case sensitive, nor does it recognize if the target word is embedded. So any email with the word 'hi' anywhere in the subject would get deleted. (e.g. this, Chicago, chickenpoop, etc) It was also suggested that the exception be if your name was in the To or CC, but we use so many distribution lists, that wouldn't matter too much.

    *sigh*

  • by Rob.Mathers ( 527086 ) on Tuesday December 04, 2001 @07:05PM (#2656687) Homepage
    While watching my local news, i heard the following quote: "The goner virus can also strike through ICQ programs like MSN Messenger." I'm beginning to dread any newscasts on tech related issues.
  • unique (Score:3, Funny)

    by sheetsda ( 230887 ) <doug@sheets.gmail@com> on Tuesday December 04, 2001 @07:14PM (#2656733)
    "Always remember you're unique, just like everyone else." I wish I knew who said it.
  • by Anonymous Coward on Tuesday December 04, 2001 @08:18PM (#2657082)
    No wonder most Slashdotters have few friends...
  • by FFFish ( 7567 ) on Tuesday December 04, 2001 @09:28PM (#2657386) Homepage
    You've made an interesting point. Other manufacturers are held liable for end-user incompetence: why isn't Microsoft?

    Ever wonder why your hair-dryer has a warning that you shouldn't use it in the shower? It's very likely because some evolutionary dead-end once actually did use it in the shower, and a lawsuit came of it.

    Hell, it even happens in Canada: some dumbshit teenager pulled a Coke machine onto himself, and his parents are trying to sue Coke for his abuse of the property!

    Obviously, it's quite acceptable to find companies liable for the carelessness, incompetence, stupidity, or maliciousness of their products' users.

    I fail to see why Microsoft isn't held accountable.
  • by Ratbert42 ( 452340 ) on Wednesday December 05, 2001 @12:49AM (#2658178)

    "The Bearcat Online email system is now blocking all messages with "Hi" as the subject."

    Will someone please write a virus that uses the subject lines "Timesheets" or "Status"?

  • by PugMajere ( 32183 ) on Wednesday December 05, 2001 @02:59AM (#2658531) Homepage Journal
    I read that as "ruining".
  • by Malcontent ( 40834 ) on Wednesday December 05, 2001 @04:14AM (#2658675)
    And they say linux is hard to use. You have to fire up a C compiler just to delete a file. Sheesh..

Two can Live as Cheaply as One for Half as Long. -- Howard Kandel

Working...