Slashdot is powered by your submissions, so send in your scoop

 


Forgot your password?
Close
typodupeerror
×
Worms Security Communications

Worm With Rootkit Package Loose On AIM 438

Posted by Zonk from the aol-and-a-rootkit-ouch dept.
Mr0624 writes "According to a recent article on C|Net a new worm is swiftly spreading via AIM to many computers. It delivers a brutal root-kit which bypasses security software and takes control of a PC." From the article: "The worm was spotted in an AOL IM chatroom and infected one of the PCs that FaceTime uses for worm bait. The company said it also has seen the pest hit other computers. 'It is still out there, and it is definitely something the user should be leery of ... The rootkit is designed to not be detected, and that is the scary part.'"
This discussion has been archived. No new comments can be posted.

Worm With Rootkit Package Loose On AIM More

Worm With Rootkit Package Loose On AIM

Comments Filter:

  • Only Chat room users affected? (Score:5, Interesting)

    by BoldAndBusted ( 679561 ) on Sunday October 30, 2005 @10:31PM (#13912138) Homepage
    So, I use GAIM, and I never use the Chat rooms. Should I worry?

    • Re:Only Chat room users affected? (Score:5, Funny)

      by jZnat ( 793348 ) * on Sunday October 30, 2005 @10:33PM (#13912148) Homepage Journal
      And I use Linux, so I'm assuming there's no need to worry. WINE isn't stable enough to support a virus/worm/trojan/etc.

    • Re:Only Chat room users affected? (Score:5, Informative)

      by AnamanFan ( 314677 ) <anamanfan&everythingafter,net> on Sunday October 30, 2005 @11:00PM (#13912289) Homepage
      Assuming you're on a Windows operating system.

      Use of GAIM [sf.net] will only prevent propagation of this worm. There are more levels at play here.

      The worm is actually installed from a link you would click on from an infected IM. Nothing fancy here, it's just a simple HTML link. Clicking on this link will call up your web browser. What happens here depends on both the browser, patches, browser settings, and you. In IE, it's likely that the executable will just run it. Or, ask you to download/run said file. The latter true for Firefox or Opera as well as IE.

      In any case, if your computer runs this executable, the computer in infected and it's game over. BUT, you won't be spreading the worm to others since you're using GAIM. The spreading of the worm depends on the AIM (or AOL?) client running on the computer.

      That is until the worm writers also write for GAIM.
    • Hmmm... Probably not. However, I would suggest not downloading and running any exe files from unknown sources. Unlike the idiots usin AIM who've been hit with this.

      But you know what? I'm not going to be frightened by a worm or virus until someone writes one that works via bittorrent.

      IE: The worm is a compact, surreptitious BT/Kademlia client. There are distributions of the nasty part built for Win32, OSX, and Linux, floating on the torrentstream. The nasty part can be any size, and has constantly updated exploit code for numerous pluggable targets (for example, you, as the virus writer, could add a torrented executable for exploiting a new bug in filezilla server, or in Apache, etc.) The virus core would download this and run it on the local machine. It could even be "smart", and detect the target machine's servers before getting and running the exploit. Once the exploit is run at the target machine, it uploads the BT client virus core for the appropriate architecture, and the process starts again.

      One could use the usual tools for preventing detection and removal: polymorphic code, torrential code (code that is split on function barriers and resorted in random order on a per-spread basis), multiple copies, Knowing your Permissions (IE: run itself as user X, make user X root/admin, set permissions so that only user X can know the executable and process exist.) Persistent regression (IE: making sure that the executable is in the startup files of the OS) Trojaning, masking (encoding the executable and running itself via a decoder program) ...

      Y'all should be happy I don't write virii. I've been fighting with them so long, I think I'd be pretty good at it...

      • Re:Only Chat room users affected? (Score:5, Funny)

        by earthbound kid ( 859282 ) on Monday October 31, 2005 @01:29AM (#13912897) Homepage
        Back in the days of CRTs, I was always waiting for someone to write a virus that sets your refresh rate so high that your monitor catches fire. That would have been a cool virus. It's probably too late for it now though.

      • IE and i.e. (Score:5, Informative)

        by stonedonkey ( 416096 ) on Monday October 31, 2005 @03:01AM (#13913168)
        IE: The worm is a compact, surreptitious BT/Kademlia client.

        Took me a second to realize that "IE" meant "id est" and not Internet Explorer. And "id est" means "that is," not "for example," also known as e.g. (exempli gratia).

        Handy cheat sheet:

        i.e. = id est = that is (not commonly captitalized, or puncuated as an acronym like IE)

        e.g. = exempli gratia = for example

        There's your pendantic lesson of the day :p

        • Re:IE and i.e. (Score:3, Informative)

          by PakProtector ( 115173 )

          IE: The worm is a compact, surreptitious BT/Kademlia client.

          Took me a second to realize that "IE" meant "id est" and not Internet Explorer. And "id est" means "that is," not "for example," also known as e.g. (exempli gratia).

          Handy cheat sheet:

          i.e. = id est = that is (not commonly captitalized, or puncuated as an acronym like IE)

          e.g. = exempli gratia = for example

          There's your pendantic lesson of the day :p

          Now, let me pedanticly correct you. I.e. does indeed stand for 'id est,' but 'id est' do

        • Re:IE and i.e. (Score:3, Informative)

          by suwain_2 ( 260792 )
          This aren't "real" translations, but I find this to be easier to remember:

          i.e. = "in effect" ("in other words")
          e.g. = "example given"

          Just think of it as a handy mnemonic device as opposed to literal translations.

    • Re:Only Chat room users affected? (Score:5, Interesting)

      by thesnarky1 ( 846799 ) on Monday October 31, 2005 @01:12AM (#13912828) Homepage
      Yes.... your friends who don't can still send you the link. If you click it, boom. I've cleaned this off of 5 systems this moonth among my friends, Two GAIM, and 3 AIM. Its a nasty virus, I might add, and I don't think the article does it justice. Yes, it prerys upon P2P, but the worst part is, most users will click that link before thinking, so its free bait. This is social engineering at its worst, and the only way to stop it is to tell your friends and family right now. No, this is not a chain letter, this is a plea for help, I can only reach so many people on my own. For instance, my away message on AIM right now deals with this article, and the virus.
      To answer the parent's question, as long as X person out there has this virus, you are affected, because they can send you the link.

  • duh (Score:5, Insightful)

    by Anonymous Coward on Sunday October 30, 2005 @10:32PM (#13912141)
    "'The rootkit is designed to not be detected, and that is the scary part.'"

    ummm isn't that the definition of a root-kit?
    • http://www.jayloden.com/VirusClean.htm [jayloden.com]

      This tool is updated almost daily. 100% effective, I can vouch for it. You can become infected if you click the link on non-AIM clients, but it won't spread to everyone else on your buddylist.

    • Re:duh (Score:5, Informative)

      by killa62 ( 828317 ) on Sunday October 30, 2005 @11:03PM (#13912301)
      Actually, rootkits go out of their way to be undetected.
      (Shamelessly stolen from grc.com)
      "What happens is, they essentially modify the way the OS itself works. They're compromising the operating system kernel. You know, in operating system terminology we have the notion of a kernel, which is the OS core. And then you've got applications which run as sort of clients of that operating system. So a program you're running, you know, Corel Draw or Outlook or whatever, that's a client of the operating system. Well, so are the spyware scanners. So when you're running even a spyware scanner, it's saying to the operating system - in fact, for example, there are two API calls that's "find first file" and "find next file." So if you ever want to, like, do a directory listing, you'll say "find first file *.*," and it gives you the first file. And then you successively call "find next," "find next," "find next," until it returns no more files. That's all there is to it. So that's - so anything that's scanning your system is basically doing that.

      Well, imagine if something altered the way the "find first" and "find next" operated, so that it was intercepting the response back to you, out of the operating system, back to any application that was asking, so that if it was about to report one of its own files, it would call - it would say, whoops, and call "find next" again on your behalf, skipping over that file. Suddenly any program running on the operating system will not see any of those stealthed, rootkitted files. They just disappear. "

      link
      http://www.grc.com/sn/SN-009.htm [grc.com]

    • Re:duh (Score:5, Interesting)

      by Billly Gates ( 198444 ) on Monday October 31, 2005 @12:22AM (#13912644) Journal
      Try explaining that to grandma? After all her antivirus software said nothing was installed right?

      Explaining about api's only makes you look incompentant if your an It professional because your not speaking down to their language to build confidence.

      I had a rootkit last month. Nothing could get rid of it but a full fdisk/mbr where I lost everything. It was MBR based and would append itself when running windows which made it nearly impossible to delete.

      Watch as spyware makers do this in the future to prevent anyone from deleting their wares.

      • FDisk in 2005? (Score:3, Informative)

        by Anonymous Coward
        I had a rootkit last month. Nothing could get rid of it but a full fdisk/mbr where I lost everything. It was MBR based and would append itself when running windows which made it nearly impossible to delete.

        It's 2005 and you only tried FDisk? There's a number of free boot record editors that could have fixed anything. There is no rootkit that I know of that is based out of the MBR the way the old Pakistani virus did to Apples. If I have a customer who needs data recovered off a rootkit infected computer I

  • Who of us actually would click... (Score:4, Funny)

    by rkitchen ( 723927 ) on Sunday October 30, 2005 @10:32PM (#13912146)
    "Check out these great new pics of us!! LoLz :)"

    • Re:Who of us actually would click... (Score:5, Insightful)

      by Nuskrad ( 740518 ) on Sunday October 30, 2005 @10:36PM (#13912169)
      Probably very few of *us*, if you're referring to Slashdot readers, who we shall assume have some degree of computer literacy. However, the vast majority of internet users are idiots. Simple fact.
      • You want to know scary? My mother asked me where the Desktop was.

      • Re:Who of us actually would click... (Score:5, Insightful)

        by macsox ( 236590 ) on Sunday October 30, 2005 @10:52PM (#13912250) Journal
        i don't know why i'm engaging on this, but i will.

        the vast majority of internet users are not idiots -- they are merely undereducated about computers and the internet.

        my nice response to your comment is that you should try to appreciate that not everyone has the time, energy or will to learn computers to the extent that you or i have.

        my mean response is as follows: i have a theory. kids start out life talking about how they want to be astronauts, or the president, or teddy bruschi.* they see a vast world of limitless possibility and imagine themselves filling up an enormous space within it. as people age, they start to realize that they most likely won't be a michael jordan or a bill gates, and their response is not to be content being a small fish in a big pond -- it's to reduce the size of the pond that is 'important'. so, i, for example, work in politics. it's easy for me to see the political world i inhabit as the most important thing locally, or even in the world, and to feel very self-important as a result. many users on slashdot see the world of tech as the pond. or their own i.t. departments. people reduce the scope of the important world, until they are a big fish. i call this, uncleverly, 'resizing the pond'.

        i posit that you are resizing the pond. and, further, that you shouldn't.

        </self-righteousness>

        * don't know who this is? there are people who would call you an idiot if you didn't.

        • Re:Who of us actually would click... (Score:4, Insightful)

          by geminidomino ( 614729 ) * on Sunday October 30, 2005 @10:56PM (#13912271) Journal
          the vast majority of internet users are not idiots -- they are merely undereducated about computers and the internet.


          "Hey, you don't know me, but I just KNOW you'll love what I have in this box. Go ahead, take it home and open it."

          Trusting complete strangers isn't a mark of techno-ignorance, it's a mark of idiocy.

          • Hey kid, want some candy? (Score:5, Insightful)

            by Kadin2048 ( 468275 ) <.ten.yxox. .ta. .nidak.todhsals.> on Sunday October 30, 2005 @11:20PM (#13912370) Homepage Journal
            Actually it's more like the old adage about taking candy from strangers. "Here, eat this! You'll like it!"

            Most people just don't make the mental connection that they could click on a link -- something they do pretty often and usually without incident -- and cause serious harm to their computer.

            I vote that it's more ignorance (to a certain degree self-imposed, because a lot of people could understand a lot more about their computers if they wanted to, but simply choose not to) than a lack of ability or mental capacity.

          • Re:Who of us actually would click... (Score:4, Insightful)

            by macsox ( 236590 ) on Sunday October 30, 2005 @11:20PM (#13912371) Journal
            first of all, you seem to think that going to best buy is the same as buying things from people in alleys. which i have to say is a bit simplistic.

            second, trusting complete strangers is a mark of being able to function in society. when you leave the house, do you need to ensure that everyone driving down the street is a friend or acquaintance? when you go to a restaurant, do you get background checks on the staff? from whom did you buy the aluminum foil to make your hat? mom?

          • Re:Who of us actually would click... (Score:4, Insightful)

            by Toasty981 ( 43996 ) on Sunday October 30, 2005 @11:29PM (#13912413) Homepage


            "Hey, you don't know me, but I just KNOW you'll love what I have in this box. Go ahead, take it home and open it."

            Trusting complete strangers isn't a mark of techno-ignorance, it's a mark of idiocy.


            I think part of the problem--and nothing earth-shattering here--is that people still think of PCs as a regular appliance. I know people who think of websites the same way they would think of turning on a TV show. If a friend tells you to turn on a station, nothing bad could happen to the TV. They tend to think the same of a website.

            Now, the question is whether people who get infected learn their lesson...that's what I'd like to see. Anyone know of any studies or such related to that? Do people take security more seriously once it happens? You'd think so, but we all know people who went back to using IE after we install Firefox/Opera/other because the Flash games wouldn't work.
            • Now, the question is whether people who get infected learn their lesson...that's what I'd like to see.

              I doubt it. Most really clueless people will never know that their PC has been rooted, they'll just eventually notice that it's slower than crap (because it's saturating their 1Mb/s cable modem line with packets as part of a DDoS attack) and when it finally becomes unbearable, call GeekSquad or take it down to CompUSA to have it reformatted.

              Then they'll start using it again, eventually become re-infected, w

          • Re:Who of us actually would click... (Score:5, Insightful)

            by herriojr ( 792305 ) on Sunday October 30, 2005 @11:49PM (#13912506)
            You're not taking into consideration that it's a message from someone on your buddy list, not a perfect stranger.
          • Trusting complete strangers isn't a mark of techno-ignorance, it's a mark of idiocy.

            What strangers? The links come from people that have you on their buddy list.

        • ... astronauts, or the president, or teddy bruschi.*

          * don't know who this is? there are people who would call you an idiot if you didn't.

          You mean Tedy Bruschi, surely. Excellent points otherwise though.

        • Undereducated I can deal with. An idiot is someone who believes "Turn $6 into $60000 in just 10 days" or doesn't question when someone without any provocation links them to a site they've never seen before.

        • the vast majority of internet users are not idiots -- they are merely undereducated about computers and the internet.

          my nice response to your comment is that you should try to appreciate that not everyone has the time, energy or will to learn computers to the extent that you or i have.

          Maybe the vast majority of internet users should take the little bit of time to appropriately learn about computers and the internet. I'm not saying everyone who uses a computer should be system admins, but I don't thi

      • I got an IM with a url for some virus/ worm/ exploit from my girlfriend, and it really almost convinced me. It simply said:

        "YES!!!! (link next to it, just like a pasted url)"

        She says "yes!!" just like that, so my gut feeling was that she found something cool online. Fortunately, I thought better of it when I saw that it was a .com file.

        Another time I actually did click on one of those, due to the fact that I was really quite groggy (computer was right next to bed, and I just had been woken up). I

    • Re:Who of us actually would click... (Score:5, Funny)

      by karvind ( 833059 ) <karvind.gmail@com> on Sunday October 30, 2005 @10:36PM (#13912170) Journal
      :(

      You cheated, there was no link in your post. I have been clicking on the post for last 10 min, nothing happened.

    • Who of us actually would click... "Check out these great new pics of us!! LoLz :)"

      Add on
      "Jenny got drunk and decided to stripteaze!!"
      and I bet alot of "us" would...

      Tm

    • Who of us actually would click... "Check out these great new pics of us!! LoLz :)"

      The sad thing is, people do! And not only do they click the link pointing at some odd site, they download a file, and execute it!

      There was an AIM trojan similar (but not the same, I believe) that got circulated to me (by a few of my 'friends') this last week. It's text was something like, "check out these kewl pics of me!" Now, if anyone I know said "kewl" that'd instantly throw red flags. (And still, I got that same IM

  • *yawn* (Score:3, Interesting)

    by patio11 ( 857072 ) on Sunday October 30, 2005 @10:33PM (#13912152)
    Summary of TFA: "You might have seen this trick before. A friend points you to a link to an .exe file. You click on it and, ignoring the security message which pops up, attempt to run it. Bad stuff happens. BUT WAIT! Now bad stuff includes a 'root kit', too! Doesn't that sound scary and hacker-y?"

  • Designed not to be detected - as compared to...? (Score:5, Insightful)

    by Telcontar ( 819 ) on Sunday October 30, 2005 @10:34PM (#13912154) Homepage
    "The rootkit is designed to not be detected, and that is the scary part."

    You can often judge the quality of the articles linked to by /. by their summaries. Check the definition of root kit [wikipedia.org] before writing such a summary. One would hope that at least story submitters are more competent than the average journalist - but then again, this is /. :-)

  • Um... (Score:4, Insightful)

    by Anonymous Coward on Sunday October 30, 2005 @10:34PM (#13912157)
    The rootkit is designed to not be detected

    So ... most rootkits are designed to be detected?

  • Noteworthy tools (Score:5, Informative)

    by nmb3000 ( 741169 ) on Sunday October 30, 2005 @10:35PM (#13912163) Journal
    I suppose that anyone in the computer tech/repair shop industry might appreciate tools like Rootkit Revealer [sysinternals.com] right now.

    Hopefully Microsoft's project [microsoft.com] that hasn't been released yet will show up soon. They also have a few hints to detect rootkits installed on a system including two Slashdot [slashdot.org] links [slashdot.org].

    Hooray for AOL.

  • Old.. (Score:5, Informative)

    by Chickenofbristol55 ( 884806 ) on Sunday October 30, 2005 @10:36PM (#13912164) Homepage
    This is actually pretty old news, one of my friends got this a few weeks ago (he's not a geek, and he called me because I build this custom pc for him). It's quite easy to fix though, a good Ol' system restore fixes it, and there are many programs that can search for, and delete rootkit and other trojans (i'm talking about other programs besides antivirus programs, which sometimes have a hard time deleting these buggers). The trojan was called directX.exe, found in windows/system32 folder. My suggestion: don't click on a link from a friend before 1) you know what it is 2) and make sure that it doesn't say that your downloading a video file, when it's obviously a batch or exe file. This virus is not really a big deal, you just have to have half a brain to deal with it.
    • My suggestion: don't click on a link from a friend before 1) you know what it is 2) and make sure that it doesn't say that your downloading a video file, when it's obviously a batch or exe file. This virus is not really a big deal, you just have to have half a brain to deal with it.

      Is this a duplicated post. I am sure I read this in 1995 ;-}
    • This virus is not really a big deal, you just have to have half a brain to deal with it.

      The problem is that most of the users on the Internet would have a hard time putting half a brain together between them.

      Intelligence in the Universe is a constant. The population is growing. You do the math if you can. :)

      There should be a project created that is designed to catch idiot users. If they are caught clicking on links in unsolicited emails/IM sessions, buying things from spam, or replying to 419 sca

    • Re:Old.. (Score:5, Insightful)

      by Anonymous Coward on Monday October 31, 2005 @12:32AM (#13912679)
      It's quite easy to fix though, a good Ol' system restore fixes it, and there are many programs that can search for, and delete rootkit and other trojans (i'm talking about other programs besides antivirus programs, which sometimes have a hard time deleting these buggers).

      Rule #1 when dealing with rootkits (or other break-ins)... The system can no longer be trusted. That means any and all executables on the system are suspect (including System Restore functionality) and may have been tampered with.

      On a unix/linux box, that means shutting the system down and booting from read-only media that cannot be tampered with. Then you use tools that are only on the CD/DVD to investigate the system and find out what files have been changed / corrupted / hijacked. This is where tools like Tripwire come into play (or simply using fingerprinting tools like md5sum and doing a diff between two sets of signature files).

      On a Windows box, you're better off with a format and re-install from CDs. Or, if you thought ahead and created a disk image using Knoppix, you could restore using that image. (Be sure that it's an image that you know is clean.)

      Luckily for you, it sounds like the worm that you dealt with was apparently not very sophisticated. But how can you be sure that you've removed that rootkit from the system? And who's to say that the next one won't interfere with System Restore?

      Never assume that worm writers are stupid. Don't assume you can outsmart them. However, most of the time (unless you are a specific target), worm writers are looking for the biggest return for least effort. So a worm that infects the majority of hosts is enough and they will not bother writing the code to infect the rest.

      IOW, if System Restore functionality begins to have a significant impact on infection rates, you should plan on System Restore functionality being broken by future worms.

      In summary:

      - Backup your data files regularly.
      - Boot a Knoppix CD/DVD and fingerprint your system regularly for a baseline to compare against at a future date.
      - Use that Knoppix CD/DVD to create snapshot images of your currently working (and uninfected) system.
      - If you're infected / invaded, assume that you haven't found everything and will need to rebuild the system from scratch.

      (Yes, I've fought off a rootkit once. It was a real pain.)
  • or "Administrator", rootkit designers don't even need to escalate privelages. I can't wait for Vista :|
    • Due to poor software design, it's difficult to not run ad admin. Most programs run no problem, be some, like WinAMP, need to have their directory permissions changed to run and a non-admin. While this isn't a problem for power users, most users won't even know how to change the permissions (in XP Home you need to boot into safe mode to get the security tab to appear in the file properties windows)

      Despite the fact that the \Documents and Settings\username folder exists, some developers choose not to use it,

  • Root kits (Score:5, Funny)

    by Rufus211 ( 221883 ) <rufus-slashdotNO@SPAMhackish.org> on Sunday October 30, 2005 @10:45PM (#13912212) Homepage
    "The rootkit is designed to not be detected, and that is the scary part."

    As opposed to those root kits that are designed *to* be detected? Damn it, thinking again instead of being scared into buying something. Really need to work on that...

  • Wow... (Score:2, Insightful)

    by megabyte405 ( 608258 )
    Not sure how you have a rootkit on a system (Windows) that doesn't have a "root" user per se... Presumably it's so called because it gets admin privs, but they aren't needed for much on Windows. It's not even that tough to remove, and I've seen it starting a few weeks ago. Much ado about nothing on C|Net is what this looks like - AIM worms aren't anything new, especially not when you work with college students.

    • Re:Wow... (Score:3, Informative)

      by oPless ( 63249 )
      Actually it's much worse.

      Administrator privs on windows is pretty much "root" as far as users are concerned *but* there is a higher level of privs. The SYSTEM user, which has a complete control (iirc, and I might not cos it's 4:30am here) it's near enough acting like the operating system as makes no difference.

      rootkits tend to get themselves to SYSTEM privs :o(

  • malware social engineering (Score:3, Insightful)

    by G4from128k ( 686170 ) on Sunday October 30, 2005 @10:54PM (#13912255)
    TFA suggests that this worm (technically a trojan) spoofs a buddy -- making the worm-loading link seem innocent. The advice is to always confirm that your buddy sent you something. I leave aside the reality that most people aren't going to pester their friends with a "Did you just send me something" messages. It may be good advice, but most people probably feel like paranoid lusers asking every time a buddy sends a link.

    The bigger point is that malware need only become better at social engineering to convince most people not to ask. If the worm sent two messages -- one with the link and a second one with a friendly confirmation ("Hope you liked that link. See you later."). This could easily convince many people that it was a trusted link from a trusted source. By the time they actually talk to the friend (if they do) and mention it, the friend will deny sending anything, the infected person will check their PC, find no evidence of an infection and just be puzzled by the exchange. But it will be too late.

    Yes, some people might still ask or be suspicious. But infectious malware needs only to succeed with a very small % to create a very large and valuable botnet.

  • Well... (Score:5, Funny)

    by slavemowgli ( 585321 ) on Sunday October 30, 2005 @10:54PM (#13912256) Homepage

    It delivers a brutal root-kit [...]

    As opposed to the usual kind and gentle root kits, I suppose?

    The rootkit is designed to not be detected, and that is the scary part.

    Isn't that part of what makes a root kit?

  • Ad Nauseam (Score:2, Insightful)

    by Secret Rabbit ( 914973 )

    "This is the first time that we have seen a rootkit as part of the bundle of applications that is sent to your machine. It is a disturbing trend."

    One worm does not a trend make.

    "The rootkit is designed to not be detected, and that is the scary part."

    Isn't this the actual point of any worm/virus/etc. To not be detected so as to be able to do what it's supposed to do. Haven't these things been doing this even before the 90's... really since the beginning.

    This is just more typically stuff.

  • Just curious (Score:3, Interesting)

    by max born ( 739948 ) on Sunday October 30, 2005 @11:04PM (#13912302)
    "A very nasty bundle is downloaded to your machine" when you click on the worm link ...

    Why with anyone write a chat program where you can install (and obviously run) a program just by clicking on a link?

    Besides that, in Windows isn't there a way to run programs (like chat) as an innocuous (nobody) user limited only to that user's home directory and with limited write capabilities?

    What gives?

  • 'Rootkit' detection (Score:2, Informative)

    by dedazo ( 737510 )
    OK, I have a beef with this beign called a 'rootkit'; it's really a trojan that can hide itself very well. But anyway. SysInternals has a sort-of 'rootkit' detector called Autoruns [sysinternals.com] that looks at everything that is loaded on to kernel and userspace at boot time. It's extremely useful because it provides an abridged view of what your PC is running when it starts. This is not a 'clik here' end user tool - you have to know what you're looking for. But I used it a few months ago to get rid of a nasty worm on a f

  • Spyware Included (Score:2, Interesting)

    by diagonalfish ( 724371 )

    The worm also places several spyware and adware applications, including 180Solutions, Zango, the Freepod Toolbar, MaxSearch, Media Gateway and SearchMiracle, the company added.

    So, would you like some spyware with your virus at no extra charge? I know this is fairly common, but does this imply that the people that make the viruses are the same ones that make the spyware we have grown to know and love? It seems that the line between "spyware" and "malware/viruses" gets more blurry every day.

    • Re:Spyware Included (Score:2, Interesting)

      by PinkFreud ( 51474 )
      Actually, whomever released this particular worm is likely making money off the installed spyware via a referral-type scheme.

      That's how it's usually done with malware nowadays - the authors of spyware typically don't care who is installing their crap on peoples' computers or how they're doing it. A worm author (or just someone releasing it) can sign up for an account with these spyware companies, and simply make sure the account is referenced when the spyware is installed on an unsupecting victim's machine
    • > I know this is fairly common, but does this imply that the people
      > that make the viruses are the same ones that make the spyware we
      > have grown to know and love?

      No, just distributors for them.

  • been here before (Score:4, Interesting)

    by jordan ( 17131 ) on Monday October 31, 2005 @01:34AM (#13912915) Homepage
    we warned them once [w00w00.org] , we warned them twice [w00w00.org] .

    silly AOL, will they ever listen?

  • About the rootkit (Score:4, Informative)

    by nightcrawler77 ( 644839 ) on Monday October 31, 2005 @02:20AM (#13913042)

    This looks like the same worm a friend of mine got a few weeks ago. I loaded it up in VMWare and discovered that it installed, among other things, the "FU" rootkit [rootkit.com].

    I took a rootkit class at this year's Black Hat Training from the guy who wrote FU. He pointed out that it's more of a proof-of-concept rootkit. It does allow you to hide files, registry keys and drivers from both user-mode and kernel-mode processes, but, it really doesn't go out of its way to hide itself from every possible angle, so detection (and thankfully, removal) wasn't that bad.

    I was able to whip up a little app to fix it from within Windows. But had the worm's author actually expanded on FU's techniques and done a better job of hiding the rootkit, recovery would not have been as nearly as easy. (Just imagine how much fun would it be to talk a novice through Windows XP's Recovery Console!)

    Once the worm authors start to get better at exploiting the potential of rootkits, we've definitely got a much better problem on our hands. The old "1. get infected, 2. run anti-virus to disinfect, 3. repeat" cycle just won't work anymore. Good luck even finding a well-implemented rootkit once it's in your kernel, let alone trying to clean it up while it's effectively able to veto every action you take.

    (Yet another reason why no Windows user should run as an Administrator.)

Slashdot Top Deals

He has not acquired a fortune; the fortune has acquired him. -- Bion

Close