RSSPotentially Devastating New Worm Makes Rounds
By David Worthington | Published January 26, 2004, 11:07 PM
A virulent new worm is stuffing inboxes across the Web. Novarg.A, otherwise known as "Mydoom" or "MIMAIL.R", began showing up on the radar screens of antivirus vendors on Monday with a frequency that alarmed security experts.
Early reports indicate that Novarg may soon eclipse the devastating Sobig.F virus should it continue to spread at its current pace.
The virus poses as a returned e-mail using subject headers such as: "Mail Delivery System," "Mail Transaction Failed" and "Test". The message is paired with file attachments containing the viral payload and text stating, "The message contains Unicode characters and has been sent as a binary attachment." Additional characteristics decoded from the virus can be found at Symantec's Security Response Web site.
Aside from infiltrating its way across an infected mail client's address book, Novarg attempts to spread itself by leveraging popular Windows file sharing software. Files are copied to the KaZaA download directory, posing as harmless software that will infect anyone unfortunate enough to double click.
Although recent builds of KaZaA include defensive measures to ward off viruses, Symantec suggests running external security software while the application is in use.
Sharon Ruckerman, Senior Director of Symantec's Security Response, informed BetaNews that Norvarg's social engineering design aspect may snare more tech-savvy users who generally follow safe computing practices - thus giving the worm the potential to surpass Sobig in its scope and severity. Symantec reports that the first several hours of virus activity have already exceeded Sobig's trajectory during its first 24 hours.
Despite the bleak outlook depicted by Symantec's findings, Ruckerman pointed out that the worm's severity is a 4 on a scale of 1 to 5 and quipped, "This is not taking the Net down."
Novarg will, however, attempt to take down Utah based SCO Group's Web site in a massive denial of service attack coordinated for February 1. Contrary to published reports, the attack has not been initiated at this time. The worm has a built in obsolescence set for February 12, 2004, when it will no longer continue to spread.
BetaNews contacted the ISV shortly after learning of reports that SCO was the target of such an attack. Blake Stowell, Director of Public Relations at SCO, said in a statement, "We've been monitoring the Web traffic and the bandwidth available to respond to those who are trying to access www.sco.com. From our side, everything appears to be normal, but I have been receiving reports from reporters indicating that they are able to access www.sco.com, albeit a little slower than normal. What is usually instantaneous is taking about 30 seconds to come up."
When asked whether or not SCO felt it was peculiar that the worm coincided with the recent LinuxWorld conference in New York, Stowell said, "We won't speculate about the timing of this. To do so would be unfair to the Linux community."
Several prominent UNIX and Linux vendors including IBM have been the defendants in intellectual property lawsuits waged by SCO. SCO claims that its code has been misappropriated into open source offerings.
Advisories issued by antivirus vendors suggest a remedy of disabling unnecessary network services, monitoring open ports and disallowing remote access on affected systems. At the time of publication, major vendors had already updated virus definitions to inch out the worm.
All versions of Windows from 95 up are susceptible to Novarg. DOS, Linux, Macintosh, OS/2, UNIX, Windows 3.x are not vulnerable. Microsoft's Outlook 2000 Service Pack 2 and beyond has default settings which block potentially dangerous attachments, however users of Outlook Express are at risk.
"The greater danger is to businesses running older versions of Outlook or consumer PCs using e-mail, say, Outlook Express," Senior Jupiter Research Analyst Joe Wilcox told BetaNews. "Microsoft plans to add attachment blocking to Outlook Express, but that update is months away."
The security update will be included in the second service pack for Windows XP, due out later this year.
"The sophistication of the virus is a reminder that hackers and virus writers should be treated as criminals and not noble antisocialists," said Wilcox.
Score: 0
|I dont understand how people with an average iq or above can get infected with virusses.. I havent had a virus since I was using DOS/Win 3.1.. I dont do anything specific to avoid them exept common sense.
I have Norton Antivirus installed wich just sits in the BG, I dont run any regular scheduled full system scans, I do occasionally run a full system scan after things like this appear but I never get infected. I have a popupkiller, not to kill virusses in popups but because popups are an abomination.
I get tons of emails with attatchments, I'm sure loads of them are virusses but I would never open an attatchment unless it came from some email I knew and there was information in the email telling me what the attatchment was that I recognized as something I knew someone was sending me or that I could recognize it as related to my job etc. I just would never even consider opening an attatchment saying "patch" or an returned email I never sent or any email that came from a source I didnt know without an explanation, a simple "open this please" or some other bulls*** will just not get opened if you use some common sense. Its just so obvious and perfect common sense to understand that they are potential virusses..yet people all over the planet get infected over and over and over.. Yet they are so incredibly easy to avoid 90% of the time by following one rule :
USE YOUR BRAIN!
Sure some infect due to vulnerabillities but theres no doubt that most infections come from s*upid ignorant and uneducated users..so.. yea.. do that.. and all viruscreators on this planet will have a hard time infecting anything exept their own machines!
Score: 0
|Ya, I agree. I had a virus twice cause I had to go online before I could drop a anti-virus/firewall in place and caugth them and took them off within seconds of catching them. General I just don't do anything to avoid them ether; I have AVG 6.0 Free Anti-Virus, SyGate Firewall, and all the e-maisl I check has virus scanners (updated nightly) on the server :-D
Score: 0
|You have to remember, the average IQ is under 100
Score: 0
|I totally agree, I'm right there with you and have been in the buis just as long as you have and have never used a single Virus Scanner or Firewall and have never had a single problem with my PC's...
I have 5 PC's to be exact and don't run any of that crap on any of them and NOTHING...
The biggest problem with people and their PC's is themselves...
Score: 0
|as a network admin i've watched people using their computers and i've found that many launch the attachment before reading the email. so they read who it's from (and it is often from someone they know or that _sounds_ familar), launch the attachment, and then read the email. humans are funny that way.
Score: 0
|If you don't run any av software, you're as bad as the next idiot. You could have a virus / trojan and not even know it.
Being complacent will be your downfall.
Score: 0
|Not necessarily. It really depends on ones maintenance skills, technical expertise, observation, and how they utilize the Internet. I've never ran any AV software in almost 20 years and can guarantee you that my machines have not been infected with one single virus or trojan. Worse case, some tracking cookie spyware.
Score: 0
|Thanks... I don't believe in any of the garbage software and the guys on my side hit the nail right on the head...
I know every single file on my system, processes and know my systems inside and out and no I'm not an IDIOT and I have nothing...
I've never used anything in 11 years I haven't quite made the 20 year mark yet but I never have gotten a virus and I don't plan on it and if I did I'm not dumb enough to send it on...
I know the Windows OS's like the back of my hand and I also worked killing virus's at one time and how many people that had 10-15 virus's all on one PC it was a complete joke... I had to manually destroy them all so when it comes to knowing a virus, I know what I'm looking for... KNOW YOUR PROCESSES...
As I said though regardless of what is said I will never use anything and never plan on it and if by chance I ever do get infected it's called fdisk /mbr and format and start over it should be done every 3-6 months anyway...
Score: 0
|Hi man - i also get the blues, when I see people using their computers like idiots. But this has nothing to do with IQ :-) This has mostly to do with the total neglect of everthing concerning computers. They just don't care at all and you can tell them a million times - they just don't care.
They love their cars, but they hate their computers . . .
So, please - don't go around discriminating those girls and boys, okay? Kick their ass, tell them the million and first time what you have told them before and keep cool, man.
IQ has nothing to do with ignorance. Some of the most intelligent people just don't care to think about some of the most important things in the world . . .
Score: 0
|I have to say thank you, to persons like yourself who not only flood the internet with garbage, but keep paying my big fat paycheck to clean up your messes. To all those that believe they know so much about computers that they do not need to protect them, I thank you. To those that know "every single exe" I sure hope for your companies sake you aren't responsible for their computer systems, if you are I suppose it's ok too because it's only a matter of time before I have your jobs.
Score: 0
|Once again you're being complacent, for some reason you seem to believe that you're invulnerable to any virus attack or unpatched security exploit.
I'm not saying you WILL get a virus, I'm just pointing out that you're rather arrogant :)
Score: 0
|I promise you that you are incorrect, and if not it's only a matter of time before you are eating your words. Installing patches are only 1/10th of the way to a secure system. I'll bet you think that netstat output is accurate on that non firewalled non anti-virus protected system too. LOL
Score: 0
|Their arrogance keeps us working, so hey if they want to live with blinders on it just means we eat better.
Score: 0
|Nonsense.....
Please rent a clue.
Score: 0
|Are you replying to me or the other poster? I myself run firewalls and several other layers of defense. Anyway, like I said before, it's how you "utilize the Internet". Think about that for awhile. Also, if you're so technically superior than us considering we keep your paycheck nice and fat according to you, then what are you so afraid of that you slow your system down with AV software? Try applying your matter of common sense and technical skills to the other side of the spectrum.
Score: 0
|Why do I "slow" my system down with AV software? I "slow" my PC down with AV software (note: ALL machines Windows and not) down because it is A. better than getting a bug, and B. better than answering to management why I wasn't protected when I did get bit with a bug. If your management does not care that you are unprotected, then so be it. I'll see you when they call me to clean house. ;-)
Score: 0
|Two more reasons to "slow" my computer down with AV software.
http://www.infoworld.com...4/01/28/HNiehole_1.html
http://www.securityfocus.com/news/7807
Score: 0
|Oh- FYI. Just because somebody doesn't use virus software doesn't mean they're an idiot.
I personally don't use virus software (I'll sometimes scan on one of the free sites if really must) but if you DO follow safeHex then you should be fine. (I personally keep up on the security vulns and such. I don't click on links I first check the source of the pages I DO go to before viewing them(If I do in fact do go to them.)[Besides cnn.com/etc]. I also use a text-only email client.) Maybe I'm just paranoid... But also rememeber... Virus scanners don't carry everything. I've known PLENTY of people with up to date virus scanners and 1-2 viruses on their systems. ^^
Score: 0
|*bashes head against wall, gets bored and wanders off*
Score: 0
|Just remember that it keeps the economy thriving. ;-) hahahaha
Score: 0
|If you're such a smart cookie then why would you have to explain anything to management since you could probably "clean house" instead. If you know your systems, you'd spot anything suspicious a mile away and be able to "clean house" vs. being a slave to the malicious programers and AV software companies while hiding behind your fear. But like I said, if you're technically capable.
Score: 0
|Yeah, I'm going to spot something unusual among any one of the 80+ machines I am directly responsible for without some sort of management solution including AV LOL. Had you had any experience at all you would (as everyone else does) quickly realize you are living in a dream world. What's interesting is that you are indirectly questioning my technical ability while showing that you have none what so ever. :-P
Score: 0
|Obviously you guys haven't read the posts closely the idiots out there are what also pay my pay check, because I work in IT but I still don't use and never will any of that crap and for those that do and still keep getting infected anyway and use all of that crap that's great because it keeps me working all the same and yes it pays my large pay check also...
No matter what protection people have they still seem to get all the nasties that come out... It's users themselves not the use of Virus Scanners or NOT...
Users are their worse enemies - knowing the facts is what keeps you virus free...
You don't open emails from those you don't know... You don't download files from untrusted sites... Set up proper security on your PC unless of course your still using OS Dinosaurs like 95, 98, ME...
Virus scanners and Firewalls are great for coporations only because THOSE USERS work there also... Companies are hit because they have things worth damaging and have sensitive information that others want... For the home user NO ONE CARES what you have it isn't worth crap...
I have absolutely nothing worth crap on my PC and yes if you want to try and attack me feel free you won't get anything and you won't damage anything... I run a website and I have an FTP they get attacked all the time but guess what NO ACCESS my logs full it's such a howl keep trying and good luck... But as I say again all of that crap is JUNK (Virus Scanners and Firewalls)
Score: 0
|"knowing the facts is what keeps you virus free"
Bulls***, knowing the facts and practicing good security is what keeps you virus free. Not running anti virus is like driving a ferrari without a seatbelt. Sure you can handle your ride, but what happens when the guy in front of you can't handle his?
Don't use AV, you may work in IT now but you won't for long.
'nuff said
Score: 0
|I don't think I've shown that at all compared to your assumptions of my technical ability. Anyway, I think we have a misunderstanding. On the 700+ machines I'm responsible for (stable and virus free 95% of the time), I would absolutely never consider not running some sort of AV solution. I was referring to my personal home machines. Maybe someday when you can comprehend what I am saying and have a little faith in yourself, we can up your responsibility from a measly 80 and you can come work for me!
Score: 0
|800 lol lol lol
Score: 0
|Oh, if you VPN or have any other type of connection to your office and you aren't protecting your home computers, you should be terminated.
'nuff said.
Score: 0
|What I don't get is the whole first half of the comments. People who don't use any AV software at all is asking for trouble. You think you know your processes? I could write a program in about 15 minutes that doesn't show up in the process list at all. How does knowing your processes help then? A lot of viruses these days don't even bother announcing themselves on the process list, especially if they're written well.
I also wonder why people in IT never seem to have any spelling or grammar skills whatsoever, but I guess it doesn't take much to get in an IT job these days. I'm sure this'll be taken as flamebait, too, but I've never had a virus on any of my computers either. Why? I run linux.
Score: 0
|Cellar,
I must agree with you in theory that a person with knowledge can skate by without virus scanners or firewalls on their systems. I am sure there are a number of steps that can improve system security without anti-virus software. Certainly many people who run anti-virus software still get viruses, but that usually always tends to lead back to it was not updated. I personally think that the average user should have atleast anti-virus software and maybe even a firwall installed on their systems. Unlike you and many others here I am not an IT tech at some large corporation, but a small computer business operator. I see computers from people from all walks of life everyday, and can say that none of the everyday people I see or deal with have enough knowledge to protect themselves without assistance of anti-virus software or firewalls. I also think the anti-virus software and firewalls are not enough, people need to still practice simple and safe procures while operating their computers, especially online. That being said, if you and others would be willing to elaborate more on proper steps to take to secure your computer system, I would appreciate the information.
Thanks
Tom
Score: 0
|Makes you wonder if the RIAA isn't behind this. Seeing that they have threatened things like this in the past.
Score: 0
|Im starting to see this pop up on my systems and in my users email boxes. I have full Virus software installed and servers and client machines, im not sure how this is getting through but it is.
Score: 0
|Bayshore. Yo. Ferry's runnin?
Hey. I've been getting a pop up box that tells me that my system will be shut down in one minute and then it does shut it down. Have McAfee. Have u heard of this one?
Score: 0
|Youve got the blaster virus download the fixblast utility from norton and the do you security updates
Score: 0
|That's the blaster virus, if you see the message referencing that it was initiated by NT authority... etc... etc.
As for viruses, as PT Barnum said, "There's a sucker born every minute!"
Score: 0
|Scr1bble:
Wrong order. Download the patch first, THEN the the virus removal tool. Otherwise, the virus comes right back after you remove it.
Score: 0
|The Blaster Worm is a joke and yes that is what is going on...
You would have never gotten it if you kept your Windows up to date with Windows Update...
Anyway the way to stop it without downloading anything is when you see the Shut Down screen...
Go to Start\Run and type Shutdown /a and that will kill that, then all you have to do is use Task Manager to kill or end process on Blaster.exe...
Then do a search for Blaster.exe making sure you are showing hidden files and folders...
It usually will be in your System32 folder and the Prefetch folder if you have XP just delete these files and you can also do a search in your registry for blaster.exe and delete anything pointing to it but that's really all there is to it...
Score: 0
|Thats a pretty crazy worm, i cant even access sco's site as of writing this!
i dont understand why people think that causing a DOS attack would keep a company from sueing somebody for millions of dollers! Its just not gonna happen!
Score: 0
|I don't see this as a way of stopping SCO from suing anyone nor do I believe it to be the intent. What it does display, however, is the growing discontent toward SCO. Expect it to continue to grow until the courts shut the door on SCO's delusions. Of course until it is known who the actual virus writer is we'll never know their true motivations.
Score: 0
|You can't access SCO's site because everyone wants to read their $250.000 press release.
The virus starts DDOSing on feb.1st
Score: 0
|not every computer in the world has the correct time
Score: 0
|