PhatBot Trojan Spreading Rapidly On Windows PCs

PhatBot Trojan Spreading Rapidly On Windows PCs 645

Posted by timothy on Wednesday March 17, 2004 @03:43PM from the what-and-lose-all-my-pigeons dept.

prostoalex writes "The Washington Post alerts Windows users about a new peer-to-peer backdoor client that is installed maliciously on broadband-connected computers around Asia and the United States. The client is then used for distributed DOS attacks and sending out large amounts of spam. Phatbot, according to government sources, is installed on hundreds of thousands machines already. Phatbot snoops for passwords on infected computers and tries to disable firewall and antivirus software, albeit it is detectable by antivirus packages." An anonymous reader submits a link to this description of the beast.

PhatBot Trojan Spreading Rapidly On Windows PCs

This discussion has been archived. No new comments can be posted.

Search 645 Comments Log In/Create an Account

Comments Filter:

Is it just me... (Score:4, Funny)

by FortKnox ( 169099 ) writes: on Wednesday March 17, 2004 @03:44PM (#8591171) Homepage Journal

... or does this sound dirty to you too??

a new peer-to-peer backdoor client that is installed maliciously

Virizzle (Score:4, Funny)

by DomCurtis187 ( 718788 ) writes: on Wednesday March 17, 2004 @03:46PM (#8591186) Journal

Since when did Snoop Dogg start writing code? Shizzle, dawg, dis virizzle be PHAT!

Skynet (Score:5, Funny)

by 3cents ( 741537 ) writes: <salakowske@PARISwisc.edu minus city> on Wednesday March 17, 2004 @03:48PM (#8591213) Homepage

How long before someone bootstraps a distributed Artificial life simulator to their virus and then we all watch in amazement as the first AI evolves and owns all our computers. This could never happen though...right?

Slashrank [slashrank.org]

Description of trojan is slashdotted (Score:5, Funny)

by phoneboy ( 11009 ) writes: <dwelch@phoneb o y . c om> on Wednesday March 17, 2004 @03:50PM (#8591243) Homepage

I can't find out how the gory details of backdooring a computer. Oh well, I guess I'll have to settle for the more traditional form of pr0n.

-- PhoneBoy

anyone else think (Score:5, Funny)

by Savatte ( 111615 ) writes: on Wednesday March 17, 2004 @03:52PM (#8591263) Homepage Journal

PhatBot Trojan would be a good name for a hip-hop group?

Greets to the DOI!!! (Score:2, Funny)

by Jim Ethanol ( 613572 ) writes: on Wednesday March 17, 2004 @03:52PM (#8591265) Homepage

### fictional code comment snipet ### "The PhatBot team would like to shout a big thanks to the US Department of Infrastructure for their help in beta testing PhatBot!"

Re:nice features list (Score:5, Funny)

by Joe U ( 443617 ) * writes: on Wednesday March 17, 2004 @03:52PM (#8591270) Homepage Journal

I would really like to see a worm/virus/trojan that makes the user's hard drive rip itself out of the computer, beat the user with a bat and run screaming down the hall.

Can someone code that feature?

Seriously, I would love to see one of these programs that just turns the victims internet connection OFF. Granted, I don't think it would spread very well.

Re:nice features list (Score:5, Funny)

by EndlessNameless ( 673105 ) writes: on Wednesday March 17, 2004 @03:53PM (#8591279)

:::# Checks to see if it is allowed to send mail to AOL, for spamming purposes:::

Best. Feature. Ever.

Re:Detection/Removal instructions? (Score:3, Funny)

by Neil Blender ( 555885 ) writes: <neilblender@gmail.com> on Wednesday March 17, 2004 @03:58PM (#8591320)

Has anyone come across a removal tool and/or removal instructions? They would be helpful for future reference.

Here is a helpful site. [linux.org] It provides instructions on how to get rid of windows viruses forever. Even ones not yet invented.

Re:nice features list (Score:5, Funny)

by bfg9000 ( 726447 ) writes: on Wednesday March 17, 2004 @03:58PM (#8591325) Homepage Journal

If only Microsoft gave us this much cool stuff with their godforsaken updates. I just KNOW Longhorn is gonna be WinXP with DRM (YAY!), just like XP was Win2000 with Prettiness Plus(TM), just like 2000 was WinNT with a blue default background, just like NT was Win98 with less games, just like 98 was Win95 with double the base install size, just like 95 was Win3.1 with less speed and stability, just like Win3.1 was DOS with a mouse.

What better resume than a good virus or trojan?

Want to statr the revolution in a hurry? (Score:5, Funny)

by beacher ( 82033 ) writes: on Wednesday March 17, 2004 @03:59PM (#8591333) Homepage

1) Extract Windows product keys
2) ???^H^H^H Email software keys to software@bsa.net and tell them that you think your employer is not running legitimate software. Include a paypal link for the reward
3) Profit

This bot looks NASTY.
-B

Lucky me (Score:5, Funny)

by mixtape5 ( 762922 ) writes: <hckymanr@yahoo.com> on Wednesday March 17, 2004 @04:00PM (#8591352) Journal

is installed maliciously on broadband-connected computers...
who knew that dial up internet was a form of virus protection? I dont feel so bad anymore!

Re:I'm TRULY not attempting to Troll (Score:4, Funny)

by 2MuchC0ffeeMan ( 201987 ) writes: on Wednesday March 17, 2004 @04:01PM (#8591367) Homepage

Nobody cares about the baghdad blast, or the crappy election that is going nowhere

it's a slow news day, what do you expect?

Re:Skynet (Score:5, Funny)

by NaugaHunter ( 639364 ) writes: on Wednesday March 17, 2004 @04:01PM (#8591371)

Yeah, but running only on poorly setup windows boxes would probably depress it pretty quick. We can only hope it would go full cycle of sentience-self actualization-massive disillusionment-depression-suicide before reaching anything useful.

Or it will start ordering from it's own spam and get really confused.

Re:Is it just me... (Score:2, Funny)

by CoolHnd30 ( 89871 ) writes: on Wednesday March 17, 2004 @04:03PM (#8591389)

a new peer-to-peer backdoor client that is installed maliciously
If you wanna look at it like that, they should call it "the Kobe", instead of PhatBot.

between 1 million and 2 million computers... (Score:2, Funny)

by Unnngh! ( 731758 ) writes: on Wednesday March 17, 2004 @04:03PM (#8591390)

...giving the RIAA another 1 to 2 million people to sue for--something...it is P2P after all;)

Re:Spammer-Sponsored (Score:5, Funny)

by arbitrary nickname ( 325162 ) writes: on Wednesday March 17, 2004 @04:05PM (#8591408)

But with all those features, how big is it? if Microsoft wrote something with all those features it'd probably come on 4 CDs.....

Re:Virizzle (Score:4, Funny)

by dasmegabyte ( 267018 ) writes: <das@OHNOWHATSTHISdasmegabyte.org> on Wednesday March 17, 2004 @04:07PM (#8591435) Homepage Journal

Dude, he's a PIMP.

He has the bitches write code for him.

Have no fear! (Score:1, Funny)

by rixstep ( 611236 ) writes: on Wednesday March 17, 2004 @04:13PM (#8591496) Homepage

I have heard from very reliable sources that there is absolutely no reason to panic. Microsoft are, as per usual, working on a patch for this Phatbot. Microsoft take computer security very seriously, as you all know. There are no flaws in Windows system architecture or any of the programs running under Windows - it's just the prevalence of Windows that does it. Microsoft and Windows are copyright Microsoft Corporation Redmond Washington USA.

Re:For a mainframe version... (Score:5, Funny)

by Phexro ( 9814 ) writes: on Wednesday March 17, 2004 @04:16PM (#8591527)

Jesus god, Amazon needs to partner with Google. Searching for that title got me several search results, including:

* 'The Phallus Palace: Female to Male Transsexuals'
* 'Clinical Neurology: A Modern Approach (Paper)'
* 'The World Almanac and Book of Facts 2004'
* 'When Girls Feel Fat: Helping Girls Through Adolescence'
* 'Principles of Frontal Lobe Function'

Whoever coded their search engine could use some advice from that last title.

Here's the correct link. [amazon.com]

Re:Skynet (Score:5, Funny)

by Ryosen ( 234440 ) writes: on Wednesday March 17, 2004 @04:20PM (#8591562)

Or it will start ordering from it's own spam

Great, just what I need. A trojan that needs bigger Trojans than me.

Re:nice features list - OSS based? (Score:2, Funny)

by vonPoonBurGer ( 680105 ) writes: on Wednesday March 17, 2004 @04:23PM (#8591591)

Assuming that list is correct, with all the features, what are the chances the virus author actually coded them all? I'm guessing some extensive customization probably had to go into whatever code was used. Possibly it was created using open source libraries for certain components?

Also, this strikes me as the first truly bloatware virus... how big is this thing anyway??

Re:anyone else think (Score:2, Funny)

by FrostedWheat ( 172733 ) writes: on Wednesday March 17, 2004 @04:25PM (#8591614)

Nah, would make a good DJ: PhatBot Slim

Re:Is it just me... (Score:5, Funny)

by CreatureComfort ( 741652 ) writes: on Wednesday March 17, 2004 @04:27PM (#8591637)

The Register just had a story about how a lot of the new virii are as small as 12kb, and how you could almost silk screen the code for one onto an XL T-shirt.

I would love to have a pair of boxers with this code printed on them, and in large letters overlaying the code, "Let's install my peer-to-peer backdoor client."

Re:So... (Score:2, Funny)

by Anonymous Coward writes: on Wednesday March 17, 2004 @04:27PM (#8591643)

www.mandrake.com
follow the links to download the ISO's and simply follow the steps after rebooting from disc 1.

you will now be 100% immune from any current and future microsoft compatable virus.

Re:The power of viruses (Score:5, Funny)

by thedillybar ( 677116 ) writes: on Wednesday March 17, 2004 @04:30PM (#8591672)

Very sobering, to realize how bad viruses online have gotten...
Oh good...I'm not the only one that restarts sendmail when I'm drunk...

Re:Albeit is misused here (Score:2, Funny)

by Anonymous Coward writes: on Wednesday March 17, 2004 @04:34PM (#8591705)

I AGREE!

I've was recently berated by some talking head (in writing) for insulting a clients "menstrual abilities", and making "inflammible remarks".

My boss read the letter to me, and asked me what I said to piss them off. He shit himself laughing when I told him I called the girl a halfwit.

Re:Jesus. (Score:4, Funny)

by grub ( 11606 ) writes: <slashdot@grub.net> on Wednesday March 17, 2004 @04:35PM (#8591717) Homepage Journal

"Problem lies between Keyboard and Chair".

At work we say "It was a Layer 8 problem". You can say that in front of non-geeks without them catching on.

Re:nice features list (Score:5, Funny)

by Sowbug ( 16204 ) * writes: on Wednesday March 17, 2004 @04:36PM (#8591718) Homepage

Simple. Just spam 10 million people with the following e-mail:

This is your system administrator. DO NOT DELETE THIS E-MAIL. Your computer has been infected with the latest trojan worm rotovirus. Please take the following steps to remove this infection: 1. Open your computer and remove the hard drive. If you are not able to do this on your own, ask the nearest IS worker for help. Inform him that this is to be done on direct orders from his superior. 2. Attach the hard drive to a bat using duct tape. Beat yourself severely with it. 3. While clutching the hard drive, run screaming down the hall. 4. Forward this e-mail to all your direct reports. Please instruct them to comply IMMEDIATELY. Thank you for your assistance in stopping this infection. Sincerely yours, The Management

OK, so maybe you can't get the hard drive to do it on its own, but if you make the e-mail look official enough, at least 10 people will do it for you.

Re:Is it just me... (Score:5, Funny)

by Ralph Wiggam ( 22354 ) writes: on Wednesday March 17, 2004 @04:40PM (#8591764) Homepage

FatBot was one of the members of Robot House, Bender's former fraternity. The episode is an Animal House take off and FatBot is supposed to be Flounder.

No idea if there's a connection.

-B

it runs under wine (Score:1, Funny)

by Anonymous Coward writes: on Wednesday March 17, 2004 @04:44PM (#8591805)

nice to know something does.

Re:Skynet (Score:4, Funny)

by rjelks ( 635588 ) writes: on Wednesday March 17, 2004 @04:54PM (#8591898) Homepage

Is it just me, or is this turning into one of those conversations in the basement of "That 70's Show" :)

-

Uh oh! (Score:3, Funny)

by cgreuter ( 82182 ) writes: on Wednesday March 17, 2004 @04:57PM (#8591923)

They use GPL'd code from WASTE but haven't released the whole source code! They're in a world of legal hurt now.

Re:How about a virus that educates users? (Score:4, Funny)

by Lumpy ( 12016 ) writes: on Wednesday March 17, 2004 @05:06PM (#8592024) Homepage

been there done that..

I wrote a email "virus" that simply made everyone think their hard drive was being erased andthen emailed it to all my users here at work and waited for the calls.. even after the "scare" I sent a second "virus" that silently wrote the username of the person that opened it to a file on the server... guess what... the damned sheep still did everything as normal...

you cant, educate most people. once they have a "way" of doing something it's like pulling teeth to get them to change...

hell we had people bitch for 2 months about the change in the color of the office pencil supply.

Re:nice features list (Score:2, Funny)

by Anonymous Coward writes: on Wednesday March 17, 2004 @05:24PM (#8592172)

No, Windows ME was just Windows '98 with a broken broom handle in one hand and a jar of Vaseline in the other.

Re:nice features list (Score:1, Funny)

by Anonymous Coward writes: on Wednesday March 17, 2004 @05:34PM (#8592270)

w00t,

Its peeps like you that make spreading of these trojans possible

I'm not e real M$-soft fan, but w2k and winxp do function quiete ok and safe with the proper user permissions. Never use administrator to run daily stuf.

If can run everything i want on it just with restrictive user privileges.

So youre argument s*u*c*k*s, never had a trojan, and nver [NO CARRIER]

Re:Nullsoft Waste code used? Open source scariness (Score:3, Funny)

by MasonMcD ( 104041 ) writes: <masonmcd.mac@com> on Wednesday March 17, 2004 @05:45PM (#8592436) Homepage

What happens when someone steals your source without obeying GPL or anything and turns it into a monster?

That's what Dr. Frankenstein said when he took the corpses for his creature. But he showed them, didn't he! They all thought he was crazy! Bbbut whooss teH CRzy onE now, HAH? You fooLS, YOU ALL LAUGHED, BUT IL HAV THE LAAST LAUHG!

MWAHAHAHAHAHA!

Re:Is it just me... (Score:3, Funny)

by ShortSpecialBus ( 236232 ) writes: on Wednesday March 17, 2004 @05:47PM (#8592474) Homepage

Something tells me you won't likely win the peace prize with that.

Chemistry would probably be your best bet...

Re:Is it just me... (Score:3, Funny)

by WWWWolf ( 2428 ) writes: <wwwwolf@iki.fi> on Wednesday March 17, 2004 @06:04PM (#8592705) Homepage

Shit, all the old good virii were like sub-800 bytes

Yeah, gone are the days when F-Secure folks unceremoniously categorized everything over 10 kb or so "huge and technically uninteresting" =)

Re:Virizzle (Score:2, Funny)

by Anonymous Coward writes: on Wednesday March 17, 2004 @06:45PM (#8593188)

fo' shizzle my nizzle. maybe yo don't hear good, foo. the s-n-double o-p has been down fo' a minute. Check it:
From the depths of the internet, back to localhost
Snoop Doggy Dogg, Funky, yes but of the .Doc
Went solo on that port, but it's still the same
Long Beach is the spot where I served my code
Follow me, follow me, follow me, follow me, but don't lose your grep
Nine-trizzay's the yizzear for me to fuck up shit
So I ain't holdin nuttin back, I got nmap
And motherfucker I got five on the twenty server rack
It's like that and as a matter of fact [rat-tat-tat-tat]
Cuz I never hesitate to put a craker on his back
[Yeah, so peep out the source code
You see that it's a must we drop connections]
What's my motherfuckin name?

even better (Score:5, Funny)

by Anonymous Coward writes: on Wednesday March 17, 2004 @06:50PM (#8593252)

Have it grep the HD for pr0n keywords, and mail the results to Outlook's Adressbook. After that, nobody would think little of viruses ever again...
(here in double-moral country, that is)

Fruit machine? (Score:3, Funny)

by Anonymous Coward writes: on Wednesday March 17, 2004 @08:06PM (#8593981)

Anybody remember the slot machine virus that
would store the disk's file allocation table in
memory, wipe it off the disk, and give you 3 tries to win it back?

There may be more comments in this discussion. Without JavaScript enabled, you might want to turn on Classic Discussion System in your preferences instead.

Is it just me... (Score:4, Funny)

Virizzle (Score:4, Funny)

Skynet (Score:5, Funny)

Description of trojan is slashdotted (Score:5, Funny)

anyone else think (Score:5, Funny)

Greets to the DOI!!! (Score:2, Funny)

Re:nice features list (Score:5, Funny)

Re:nice features list (Score:5, Funny)

Re:Detection/Removal instructions? (Score:3, Funny)

Re:nice features list (Score:5, Funny)

Want to statr the revolution in a hurry? (Score:5, Funny)

Lucky me (Score:5, Funny)

Re:I'm TRULY not attempting to Troll (Score:4, Funny)

Re:Skynet (Score:5, Funny)

Re:Is it just me... (Score:2, Funny)

between 1 million and 2 million computers... (Score:2, Funny)

Re:Spammer-Sponsored (Score:5, Funny)

Re:Virizzle (Score:4, Funny)

Have no fear! (Score:1, Funny)

Re:For a mainframe version... (Score:5, Funny)

Re:Skynet (Score:5, Funny)

Re:nice features list - OSS based? (Score:2, Funny)

Re:anyone else think (Score:2, Funny)

Re:Is it just me... (Score:5, Funny)

Re:So... (Score:2, Funny)

Re:The power of viruses (Score:5, Funny)

Re:Albeit is misused here (Score:2, Funny)

Re:Jesus. (Score:4, Funny)

Re:nice features list (Score:5, Funny)

Re:Is it just me... (Score:5, Funny)

it runs under wine (Score:1, Funny)

Re:Skynet (Score:4, Funny)

Uh oh! (Score:3, Funny)

Re:How about a virus that educates users? (Score:4, Funny)

Re:nice features list (Score:2, Funny)

Re:nice features list (Score:1, Funny)

Re:Nullsoft Waste code used? Open source scariness (Score:3, Funny)

Re:Is it just me... (Score:3, Funny)

Re:Is it just me... (Score:3, Funny)

Re:Virizzle (Score:2, Funny)

even better (Score:5, Funny)

Fruit machine? (Score:3, Funny)

Related Links Top of the: day, week, month.

Slashdot Top Deals