And so today I spent my morning reading Wikipedia's "list of notable 
computer viruses and worms".

All the big names are there - Byte Bandit, Chynoble, Melissa, Code Red, 
SQL Slammer, Sobig, Sober, MyDoom, MS Blaster, Klez, Nachi, etc. Plus 
there's a few I haven't even heard of. (Obviously most of these are PC 
viruses, and it wasn't until the late 90s that I started using that 
platform.)

In all the time I've been using computers, I have only seen 2 virus 
infections. At uni, I unwhittingly infected a PC with the Happy99 virus. 
[At least, I'm pretty sure that's what it was. As far as I know, nothing 
further came of this incident.]

Later, my laptop became infected with MS Blaster. This is the only time 
a computer that I personally own has become infected with a virus.

I remember being distinctly unimpressed my McAfee's ability to detect 
the virus, yet do absolutely nothing to actually remove it. It just 
whinged "oh dear, the file cannot be deleted, what shall I do?" In the 
end, I had to go delete it myself manually. (IIRC, it was read-only or 
something, and that was all that was stopping it.)

Of course, the machine instantly become reinfected. In the end I 
reinstalled Windows XP. But as soon as I attempted to access the 
Internet to download the patch, the laptop was reinfected and started 
rebooting faster than I could download the patch. In the end, I had to 
use my mum's old PC (Windows 98) to download the patch so I could 
install it.

Melissa, Code Red, SQL Slammer and ILOVEYOU are all legendary names, but 
until today I didn't actually know precisely what they did or how they 
worked. It's interesting how some of these expoit bugs that were fixed 
months ago. Others merely use minimalistic social engineering tricks.

It's surprising how stupid some people are. For example "why did you 
open this attachment 12 times??" "Well I wanted to see what was in it!" 
I guess most people don't realise that clicking on an attachment is what 
infects PCs; they probably think it's something like the common cold 
that "just happens" one day.

I've heard legends of boot-block viruses, file infectors and Word macro 
viruses - but I've never actually met one in real life. With the 
possible exception of the latter, I would imagine these are all pretty 
rare now.

Anybody else here have any interesting virus experiences?

-- 
http://blog.orphi.me.uk/
http://www.zazzle.com/MathematicalOrchid*

Post a reply to this message

Invisible wrote:

> I've heard legends of boot-block viruses, file infectors and Word macro 
> viruses - but I've never actually met one in real life. With the 
> possible exception of the latter, I would imagine these are all pretty 
> rare now.

Never encountered a boot-block virus. Had a Word document that contained 
a virus at once. Of course, that was averted by the whole "This file has 
a macro in it, do you want to run that macro" dialog. Uhh, no ... I 
wasn't expecting any macros. I met the ILOVEYOU virus. It filled up my 
entire inbox. Oh what fun that was. Of course, I knew the e-mails were 
bogus when one of the first 10 was from the CEO. I downloaded the 
script, and opened it in a text editor, just to see what it contained.

> Anybody else here have any interesting virus experiences?

The most interesting was the Worm that was infecting computers via file 
shares. I had stored a few executables on the network share after 
building them, then ran them (moments after the build completed, about 
the time it took for me to go grab a drink from the fridge) They didn't 
work ... Rebuild and execute again ... Didn't work ... Hmm... Build the 
Debug versions (local to my machine) and they worked flawlessly. Hmmm. 
Suddenly my boss shows up at my cubicle (He was also head of IT at the 
time) says "Don't touch a thing" and yanks the network cord out of the 
back of my machine. He then instructs me to open our virus software, 
download the latest update and do a full system scan. My system had been 
affected by the files I built moments before. All because someone 
attached a dodgy laptop to the LAN and logged in, reconnecting 
themselves to all of the file shares on the server, and infecting every 
single writable executable on the file share. That virus was 
particularly virulent. The writability hole was plugged on the shares I 
used so that devs were the only ones with write privileges, but it would 
appear from time to time (probably from the same individual, I dunno) 
and totally cripple the network.

Post a reply to this message

Mike Raiford wrote:

> I met the ILOVEYOU virus. It filled up my 
> entire inbox. Oh what fun that was. Of course, I knew the e-mails were 
> bogus when one of the first 10 was from the CEO. I downloaded the 
> script, and opened it in a text editor, just to see what it contained.

Anything interesting?

> The most interesting was the Worm that was infecting computers via file 
> shares. I had stored a few executables on the network share after 
> building them, then ran them (moments after the build completed, about 
> the time it took for me to go grab a drink from the fridge) They didn't 
> work ... Rebuild and execute again ... Didn't work ... Hmm... Build the 
> Debug versions (local to my machine) and they worked flawlessly. Hmmm. 
> Suddenly my boss shows up at my cubicle (He was also head of IT at the 
> time) says "Don't touch a thing" and yanks the network cord out of the 
> back of my machine. He then instructs me to open our virus software, 
> download the latest update and do a full system scan. My system had been 
> affected by the files I built moments before. All because someone 
> attached a dodgy laptop to the LAN and logged in, reconnecting 
> themselves to all of the file shares on the server, and infecting every 
> single writable executable on the file share. That virus was 
> particularly virulent. The writability hole was plugged on the shares I 
> used so that devs were the only ones with write privileges, but it would 
> appear from time to time (probably from the same individual, I dunno) 
> and totally cripple the network.

Wow. o_O

Sounds like almost as much fun as that time I accidentally configured 
our email server as an open relay. Needless to say, on Monday morning 
the server was nonfunctional. I forget what I was actually *trying* to 
do... but I missed out the step where you configure some setting or 
other that requires authentication or something, essentially yielding an 
open-relay configuration.

Oops. x_x

An a final thought... How many users would see a macro popup and decide 
to press "no"? It seems to me that lots of applications generate far too 
many popups (e.g., endless "are you sure?" messages where there is 
actually no danger), and users tend to just blindly click Yes to get rid 
of these irritations.

-- 
http://blog.orphi.me.uk/
http://www.zazzle.com/MathematicalOrchid*

Post a reply to this message

Invisible <voi### [at] devnull> wrote:
> In the end I reinstalled Windows XP.

  The (newbie) answer to all problems.

-- 
                                                          - Warp

Post a reply to this message

>> In the end I reinstalled Windows XP.
> 
>   The (newbie) answer to all problems.

Well, if your PC reboots every 20 seconds, what else can you 
realistically do? There isn't sufficient time to install any tools or 
run any kind of diagnostics.

-- 
http://blog.orphi.me.uk/
http://www.zazzle.com/MathematicalOrchid*

Post a reply to this message

"Invisible" <voi### [at] devnull> a écrit dans le message de news: 
48970aa6$1@news.povray.org...
> Well, if your PC reboots every 20 seconds, what else can you realistically 
> do? There isn't sufficient time to install any tools or run any kind of 
> diagnostics.

??? If you were able to find and download the patch from your mum's PC then 
you could also find instructions on the internet about 1) how to stop the 
rebooting before it happened and 2) to get rid of the worm without 
reinstalling.

G.

Post a reply to this message

>> Well, if your PC reboots every 20 seconds, what else can you realistically 
>> do? There isn't sufficient time to install any tools or run any kind of 
>> diagnostics.
> 
> ??? If you were able to find and download the patch from your mum's PC then 
> you could also find instructions on the internet about 1) how to stop the 
> rebooting before it happened and 2) to get rid of the worm without 
> reinstalling.

Well by the time I got that far I'd already reinstalled twice.

Reinstalling is probably simpler than following a tricky sequence of 
registry edits and hoping that you don't accidentally break your PC and 
that all traces of the virus are actually gone...

-- 
http://blog.orphi.me.uk/
http://www.zazzle.com/MathematicalOrchid*

Post a reply to this message

On Mon, 04 Aug 2008 14:02:40 +0100, Invisible <voi### [at] devnull> wrote:


>Anybody else here have any interesting virus experiences?

I was banging my head against the wall, working to figure out why our web page kept
crashing, when Code Red was announced.  That was quite a fun-filled few days.

Post a reply to this message

"Invisible" <voi### [at] devnull> a écrit dans le message de news: 
489713b0@news.povray.org...
> Reinstalling is probably simpler than following a tricky sequence of 
> registry edits and hoping that you don't accidentally break your PC and 
> that all traces of the virus are actually gone...

What registry edits? All you had to do to prevent the reboot was to go to 
the command line and type "shutdown -a" (or go the control panel and perform 
a similar task). It took a couple of seconds and the trick was explained on 
every AV site.

G.

Post a reply to this message

>> Reinstalling is probably simpler than following a tricky sequence of 
>> registry edits and hoping that you don't accidentally break your PC and 
>> that all traces of the virus are actually gone...
> 
> What registry edits? All you had to do to prevent the reboot was to go to 
> the command line and type "shutdown -a" (or go the control panel and perform 
> a similar task). It took a couple of seconds and the trick was explained on 
> every AV site.

That stops the machine rebooting, but it still doesn't remove the virus.

Personally, I just assumed that "fatal system error" means that there's 
no way to prevent the system from being rebooted. I don't recall the 
McAfee site containing any instructions on how to prevent this, or even 
suggestion that it is *possible* to prevent this. Oh dear, I must be a 
really stupid n00b for not knowing something so "obvious". Get off my case!

-- 
http://blog.orphi.me.uk/
http://www.zazzle.com/MathematicalOrchid*

Post a reply to this message

Invisible wrote:

> 
> Anything interesting?
> 

Not particularly. It was actually rather poorly written iirc, used CDO, 
I believe to read the address book and propagate itself.

Post a reply to this message

"Invisible" <voi### [at] devnull> a écrit dans le message de news: 
48971da1$1@news.povray.org...

> That stops the machine rebooting, but it still doesn't remove the virus.

The point is that it gave you plenty of time to install whatever blaster 
removal tool you had downloaded from the AV makers.

>Oh dear, I must be a really stupid n00b for not knowing something so 
>"obvious". Get off my case!

The noobishness is not about not knowing something. It's about not imagining 
that there are other people out there with the same problem and possibly 
solutions that work, all of this a Google search away. To be fair, it took 
me a while to get this, as I'm old enough to be from a generation where it 
was much more difficult to learn things on the fly...

G

Post a reply to this message

Invisible wrote:
> Anybody else here have any interesting virus experiences?

I remember the fire drills going on when the Morris Worm got out, and 
the Christmas Tree whatever-it-was. It was lots of fun not having 
internet access for a few days.

Almost as much fun as when they blow up a train tank car full of acid in 
the same tunnel that most of the east-west fibers run through in the 
USA. That one took a couple weeks to fix.

-- 
Darren New / San Diego, CA, USA (PST)
  Ever notice how people in a zombie movie never already know how to
  kill zombies? Ask 100 random people in America how to kill someone
  who has reanimated from the dead in a secret viral weapons lab,
  and how many do you think already know you need a head-shot?

Post a reply to this message

"Invisible" <voi### [at] devnull> wrote in message 
news:48971da1$1@news.povray.org...

> Oh dear, I must be a really stupid n00b for not knowing something so 
> "obvious". Get off my case!

    LOL! N00b!  ;)

    Just kidding mate, but there are internet cafe's too. Been there, done 
that with my '98 machine... :/

    (Hey, quick thought: how about going to an internet cafe to maybe meet 
someone? You know, you could give them some *specialist* info if they seem 
to be having a problem?)

      ~Steve~

>
> -- 
> http://blog.orphi.me.uk/
> http://www.zazzle.com/MathematicalOrchid*

Post a reply to this message

On Mon, 04 Aug 2008 14:02:40 +0100, Invisible wrote:

> Anybody else here have any interesting virus experiences?

I used to have a collection for testing purposes.  Ran into a weird one 
with (I think it was) Yale/Alameda on a network.  Yale tried to write to 
the boot sector, but with a networked drive, it couldn't do that 
(redirector = no access to the drive's boot sector), but it had no error 
handling for that situation.

If one was running WordPerfect 5.1 (this was the early 90's) on a machine 
infected with this virus, the code would jump into a section of WP that 
caused it to start writing huge temp files to the networked drive, 
eventually bringing all users logged into that account down.

(We used a guest account for most of the students, was easier than 
managing separate accounts for everyone and we had no need to do so - 
every student saved their work to a diskette).

This situation was completely reproducible every time.

Jim

Post a reply to this message

I'm wondering: How many virus/worm infections could have been prevented
by the simple use of a firewall software (such as eg. ZoneAlarm)?

  And more wondering: Why do people use Windows without a firewall software?
Even many who *know* these things and are not total n00bs.

  "I never run untrusted programs nor open dubious emails" doesn't help
when a worm exploits a security hole in the system which allows it to
infect it remotely without the user doing anything. And this is something
which a firewall software will usually prevent.

  (Another very important aspect of the firewall software is that, in the
case the system *does* get infected, it will stop the virus/worm/malware
from connecting to the internet behind the scenes, without the user knowing.
This is something a hardware firewall won't do, which is why a software
firewall in Windows is so important.)

-- 
                                                          - Warp

Post a reply to this message

Gilles Tran wrote:

>> Oh dear, I must be a really stupid n00b for not knowing something so 
>> "obvious". Get off my case!
> 
> The noobishness is not about not knowing something. It's about not imagining 
> that there are other people out there with the same problem and possibly 
> solutions that work, all of this a Google search away.

Yeah. I'm sure a few hours after MS Blaster came out there was published 
info on the Internet on how to fix it. :-P

For what it's worth, I *did* check McAfee's website. (Since that was the 
AV product I was actually using.) It just said "get the latest virus 
defs. The virus will then be removed." This didn't actually occur. It 
*detected* the virus, but refused to remove it. Really helpful, that was...

-- 
http://blog.orphi.me.uk/
http://www.zazzle.com/MathematicalOrchid*

Post a reply to this message

Warp wrote:
>   And more wondering: Why do people use Windows without a firewall software?

NAT tends to do a really good job here too. I think most cable modems at 
least are, by now, NATted.

> from connecting to the internet behind the scenes, without the user knowing.

Sadly, there are so many programs that connect out without telling the 
user they'll be doing so, it's another case of yes/no overload, methinks.

-- 
Darren New / San Diego, CA, USA (PST)
  Ever notice how people in a zombie movie never already know how to
  kill zombies? Ask 100 random people in America how to kill someone
  who has reanimated from the dead in a secret viral weapons lab,
  and how many do you think already know you need a head-shot?

Post a reply to this message

Mike Raiford wrote:

>> Anybody else here have any interesting virus experiences?

     I have never seen a virus on a computer. Been lucky I guess :)
I was the local greek that every one who ask for help on their computers 
  in our naborhood. Every time a new virus came out everyone thought 
they had it. The problems where mostly from loading games and programs 
that were incompatible with the operating system. I was always getting 
virus update from them. One day I got an e-mail that said there is a 
virus name Such-n-Such(can remember) and if you have this exe file on 
your computer you need to delete it. Of course it was on my computer. NO!
I didn't delete it. A little research showed that the file was very 
important to the operating system. Lucky none of our gang delete it.

Post a reply to this message

>>   And more wondering: Why do people use Windows without a firewall 
>> software?
> 
> NAT tends to do a really good job here too.

Yeah, that too.

Just being behind a NAT device means that random people in the Internet 
can't just connect to your PC and start frobbing random ports which host 
insecure services. [Insert comment about the number of services M$ has 
enabled by default when Windoze installs.]

That's not to say there is no place for antivirus and/or personal 
firewalls though! We still have spam email containing malware, and 
websites using browser bugs to install dodgy stuff...

> Sadly, there are so many programs that connect out without telling the 
> user they'll be doing so, it's another case of yes/no overload, methinks.

Well sadly yes. OTOH, many personal firewalls seem to have a list of 
"trusted" applications that they don't prompt for. Who compiles this 
list and how the product decides whether a given item is on that list is 
another matter. (I really hope it isn't just by process image name...!)

-- 
http://blog.orphi.me.uk/
http://www.zazzle.com/MathematicalOrchid*

Post a reply to this message

Leroy Whetstone wrote:

>     I have never seen a virus on a computer. Been lucky I guess :)

Lucky or just sensible. ;-)

My dad's PC seems to periodically become infected by... *something* or 
other. Usually just trojans and browser hooks. I don't know what the 
heck he does that I don't, but I've never had any similar problems...

> I was the local greek that every one who ask for help on their computers 
> in our naborhood. Every time a new virus came out everyone thought they 
> had it.

Ah yes, I've seen this so often. "Ooo, my computer is doing something 
wierd. Is it a virus?"

Also, does it make you chuckle when you see those emails warning you 
that "omgz, this nuu virus will eraz0rs your memory and make your 
monitor expl0d3!!1!eleven"? ;-)

> One day I got an e-mail that said there is a virus 
> name Such-n-Such(can remember) and if you have this exe file on your 
> computer you need to delete it. Of course it was on my computer. NO!
> I didn't delete it. A little research showed that the file was very 
> important to the operating system. Lucky none of our gang delete it.

Perhaps you refer to

http://www.f-secure.com/hoaxes/jdbgmgr.shtml

-- 
http://blog.orphi.me.uk/
http://www.zazzle.com/MathematicalOrchid*

Post a reply to this message

Thats interesting. Very few people had access to the Internet outside of 
universities, military, government and gov't contractors when the "Morris 
Worm" struck. I believe I had Compuserve at the time and found the news very 
interesting but remained utterly unaffected by it, the only actual Internet 
access we Compuserve subscribers had at the time I think, was limited to 
metered email. That was, what, 1987, 1988?


-- 
H²

Post a reply to this message

Halbert wrote:
> That was, what, 1987, 1988?

Both of those, yes.

http://en.wikipedia.org/wiki/Christmas_virus
http://en.wikipedia.org/wiki/Morris_worm

Netscape used to be the security hole poster child, too, until Microsoft 
took that distinction away from them. :-)

-- 
Darren New / San Diego, CA, USA (PST)
  Ever notice how people in a zombie movie never already know how to
  kill zombies? Ask 100 random people in America how to kill someone
  who has reanimated from the dead in a secret viral weapons lab,
  and how many do you think already know you need a head-shot?

Post a reply to this message

Invisible wrote:
> Anybody else here have any interesting virus experiences?

Want a scary thought?

While remotely cleaning a friend's computer, I found a trojan that was using
two dozen different methods to start up on boot. The global and per-user
Run registry key, Start on the start menu, an ActiveX object that
initialized on boot, a shell extension loaded by explorer, and...

...it *changed the file association of .exe files*. Instead of running "%1",
it ran trojan.exe "%1". The trojan started the real program after doing its
nasty stuff, so the user didn't notice.

Post a reply to this message

Orchid XP v8 wrote:
> how the product decides whether a given item is on that list is
> another matter. (I really hope it isn't just by process image name...!)

Some crappy old firewalls actually compared process image name.

This tool pretends to be IE and attempts connecting to the 'net. If it
succeeds, and your firewall doesn't give any warning about it, it sucks.

http://www.grc.com/lt/leaktest.htm

Post a reply to this message

>> Anything interesting?
> 
> Not particularly. It was actually rather poorly written iirc, used CDO, 
> I believe to read the address book and propagate itself.

Heh. I can easily imagine a virus not being the aphex of coding 
technology. ;-) I've seen a number of virus descriptions that talk about 
broken payloads or things not working right...

Actually, I've occasionally thought about trying to *write* a virus, 
just to see if I can do it... But that's illegal. And besides, I'm sure 
Haskell isn't the best way to do it either. :-P

-- 
http://blog.orphi.me.uk/
http://www.zazzle.com/MathematicalOrchid*

Post a reply to this message

Invisible wrote:
> Actually, I've occasionally thought about trying to *write* a virus, 
> just to see if I can do it... But that's illegal. And besides, I'm sure 
> Haskell isn't the best way to do it either. :-P
> 

No, not illegal and not a bad learning experience. Propagating a virus 
into the wild, though, is _definitely_ illegal.

John

Post a reply to this message

>> Actually, I've occasionally thought about trying to *write* a virus, 
>> just to see if I can do it... But that's illegal. And besides, I'm 
>> sure Haskell isn't the best way to do it either. :-P
> 
> No, not illegal and not a bad learning experience. Propagating a virus 
> into the wild, though, is _definitely_ illegal.

Sure. And owning a gun is illegal, but owning all of the components 
necessary to assemble a gun isn't. But good luck explaining to the 
people raiding your house why you have all these components. ;-)

-- 
http://blog.orphi.me.uk/
http://www.zazzle.com/MathematicalOrchid*

Post a reply to this message

"Orchid XP v8" <voi### [at] devnull> wrote in message 
news:48975170$1@news.povray.org...

> My dad's PC seems to periodically become infected by... *something* or 
> other. Usually just trojans and browser hooks. I don't know what the heck 
> he does that I don't, but I've never had any similar problems...

      I don't have problems now, (thankfully!) but I did on my original 98 
machine, (which was then later changed to XP). (Which is STILL sat beside me 
on the floor doing nothing!)

     Anyway, I clicked on a virus email the other day to see what would 
happen, and AVG kicked in big time (immediately) and quarantined it.

       If you can't find me after this, please send a search party, I'm 
hungry an i yo%  nee;; £$* ==-0_ irt^+"..,,''

         ~2&8*ds~   ;)

Post a reply to this message

X5O!P%@AP[4\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H*

-- 
http://blog.orphi.me.uk/
http://www.zazzle.com/MathematicalOrchid*

Post a reply to this message

"Orchid XP v8" <voi### [at] devnull> wrote in message 
news:4898b163$1@news.povray.org...


> X5O!P%@AP[4\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H*

   LOL, I'm guessing that actually means something, whereas mine didn't. 
Thanks for the laugh mate, I needed it.  :)

    AND I'M NOT CLICKING ON IT!!  :op


     ~Steve~




>
> -- 
> http://blog.orphi.me.uk/
> http://www.zazzle.com/MathematicalOrchid*

Post a reply to this message

On Tue, 05 Aug 2008 21:44:18 +0100, St. wrote:

> "Orchid XP v8" <voi### [at] devnull> wrote in message
> news:4898b163$1@news.povray.org...
> 
> 
>> X5O!P%@AP[4\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H*
> 
>    LOL, I'm guessing that actually means something, whereas mine didn't.
> Thanks for the laugh mate, I needed it.  :)

http://en.wikipedia.org/wiki/Eicar_test_file

:-)

Jim

Post a reply to this message

"Jim Henderson" <nos### [at] nospamcom> wrote in message 
news:4898be73@news.povray.org...
> On Tue, 05 Aug 2008 21:44:18 +0100, St. wrote:
>
>> "Orchid XP v8" <voi### [at] devnull> wrote in message
>> news:4898b163$1@news.povray.org...
>>
>>
>>> X5O!P%@AP[4\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H*
>>
>>    LOL, I'm guessing that actually means something, whereas mine didn't.
>> Thanks for the laugh mate, I needed it.  :)
>
> http://en.wikipedia.org/wiki/Eicar_test_file

   Haha, thanks Jim, I didn't know that existed. You guys are great.


>
> :-)

    :-)

   ~Steve~



>
> Jim

Post a reply to this message

On Tue, 05 Aug 2008 22:46:56 +0100, St. wrote:

>    Haha, thanks Jim, I didn't know that existed. You guys are great.

Hehe, GIYF. ;-)  But I had seen it before, just didn't know what the 
contents actually were.  There's also a standard file for testing UCE as 
well - used for testing SpamAssassin installations to make sure it's 
working.  I'd never heard of that one before.

Jim

Post a reply to this message

>> http://en.wikipedia.org/wiki/Eicar_test_file
> 
>    Haha, thanks Jim, I didn't know that existed. You guys are great.

Well it's a lot safer than "keeping a collection of real viruses for 
test purposes". ;-)

-- 
http://blog.orphi.me.uk/
http://www.zazzle.com/MathematicalOrchid*

Post a reply to this message

Orchid XP v8 wrote:
> X5O!P%@AP[4\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H*
> 

I'm impressed! Defender actually picked this up. Who knew it had virus 
definitions ...

Post a reply to this message

Attachments:
Download 'defender.jpg' (17 KB)

Preview of image 'defender.jpg'

Mike Raiford wrote:

> I'm impressed! Defender actually picked this up. Who knew it had virus 
> definitions ...

LOL @ threat level.

-- 
http://blog.orphi.me.uk/
http://www.zazzle.com/MathematicalOrchid*

Post a reply to this message

On Wed, 06 Aug 2008 08:59:31 +0100, Invisible wrote:

>>> http://en.wikipedia.org/wiki/Eicar_test_file
>> 
>>    Haha, thanks Jim, I didn't know that existed. You guys are great.
> 
> Well it's a lot safer than "keeping a collection of real viruses for
> test purposes". ;-)

Depends on what you want to test.  I was using it to test virus 
interaction with software; the Eicar test file isn't particularly useful 
for that.

But that's another thing that virtualization is great for - sandboxing 
for that sort of testing.

Jim

Post a reply to this message

"Invisible" <voi### [at] devnull> wrote in message
news:4896fdf4$1@news.povray.org...
>
> All the big names are there - Byte Bandit, Chynoble, Melissa, Code Red,
> SQL Slammer, Sobig, Sober, MyDoom, MS Blaster, Klez, Nachi, etc. Plus
> there's a few I haven't even heard of. (Obviously most of these are PC
> viruses, and it wasn't until the late 90s that I started using that
> platform.)

The interesting (and unfortunate) thing about SQL Slammer is that the patch
that closed the exploit had been released a couple of months before the worm
appeared. The reason is was so widespread is that most organisations hadn't
bothered applying any service packs

Post a reply to this message

Gail Shaw wrote:

> The interesting (and unfortunate) thing about SQL Slammer is that the patch
> that closed the exploit had been released a couple of months before the worm
> appeared. The reason is was so widespread is that most organisations hadn't
> bothered applying any service packs

Indeed. Some of these things use a hole that was patched a week or two 
ago, but some hit really "old" holes that were fixed ages ago.

OTOH, throwing an update onto a home PC is one thing. I guess you have 
to be a tad more careful when it's a production-grade server we're 
talking about...

(I don't know how SQL Slammer works, but wouldn't you have to have SQL 
access exposed to the Internet for it to propogate?)

Ah well, at least I know why I keep getting all those strange entries in 
my web logs... Apparently they're trying to exploit a bug in ISS. ;-)

-- 
http://blog.orphi.me.uk/
http://www.zazzle.com/MathematicalOrchid*

Post a reply to this message

Orchid XP v8 wrote:
> Gail Shaw wrote:
> 
>> The interesting (and unfortunate) thing about SQL Slammer is that the
>> patch that closed the exploit had been released a couple of months before
>> the worm appeared. The reason is was so widespread is that most
>> organisations hadn't bothered applying any service packs
> 
> Indeed. Some of these things use a hole that was patched a week or two
> ago, but some hit really "old" holes that were fixed ages ago.

I heard of a really interesting one. Microsoft found a security bug (or was
responsibly and privately notified of it by another company/individual). As
usual, on Patch Tuesday they released an update fixing it, along with other
updates.

Some motivated hacker *reverse-engineered the update*. He compared the
relevant DLL before and after the update, basically. And figured out what
the vulnerability was.

And proceeded to pwn unpatched machines.

Post a reply to this message

>> Well it's a lot safer than "keeping a collection of real viruses for
>> test purposes". ;-)
> 
> Depends on what you want to test.  I was using it to test virus 
> interaction with software; the Eicar test file isn't particularly useful 
> for that.

Surely this is going to vary arbitrarily for each individual virus?

-- 
http://blog.orphi.me.uk/
http://www.zazzle.com/MathematicalOrchid*

Post a reply to this message

Nicolas Alvarez wrote:

> Some motivated hacker *reverse-engineered the update*. He compared the
> relevant DLL before and after the update, basically. And figured out what
> the vulnerability was.
> 
> And proceeded to pwn unpatched machines.

I'm told this is standard practice now... ;-)

-- 
http://blog.orphi.me.uk/
http://www.zazzle.com/MathematicalOrchid*

Post a reply to this message

On Thu, 07 Aug 2008 08:56:40 +0100, Invisible wrote:

>>> Well it's a lot safer than "keeping a collection of real viruses for
>>> test purposes". ;-)
>> 
>> Depends on what you want to test.  I was using it to test virus
>> interaction with software; the Eicar test file isn't particularly
>> useful for that.
> 
> Surely this is going to vary arbitrarily for each individual virus?

Not necessarily.  In my example of running WordPerfect from a networked 
drive, the problem was reproducible every time.  Infect machine, start up 
WP, start doing work, WP starts creating massive temporary files on the 
network drive until the space is used up.

Similarly, we had write-protected boot diskettes for the machines, but 
the lab assistants would re-enable write by taping over the hole (3.5" 
diskettes, we'd remove the write protect tabs on the boot diskettes) so 
the diskette would get infected.  Warm boot infected machine with write 
protected diskette, you'd get a "write error" on boot every time.  The 
virus was actually coded to intercept a warm boot and keep itself in 
memory while actually rebooting the machine, then would try to write 
itself out to the boot diskette in order to spread.

Really strange to get a write protect error before DOS seemingly started 
up.

Jim

Post a reply to this message