found in WT's newspaper shop
from
'Eightball' Smacking KaZaA Users
Purported 'skin' is actually a trojan that wipes out music files.
Download the latest skin from KaZaA and you won't get a slick-looking piece of software. Instead, you'll install a virus that wipes out your music files. See what happened to our files when we tried installing the skin, tonight on "Tech Live."
Two viewers tipped us to the file, called the Magic Eightball skin. It comes as a Zip file named eightball2.zip. Once opened, the program executes on some systems, erasing music files and causing system crashes, the viewers said.
We found the skin by searching the term "eightball skin" on KaZaA. The Zip file did not execute on a Windows 98 SE machine, saying it was missing a required DLL file. But on a Windows XP machine, the file executed and popped up a dialog box asking if we wanted to "see some magic."
We clicked on Yes and five more dialog boxes popped up, each one counting down: five, four, three, two, and then one.
When we finished, all of the MP3 files stored on our system were gone. The system began popping up error messages, and we had to reboot the machine.
Steve Trilling from Symantec's Antivirus Research Center says he's seeing more cases of malicious code designed to exploit peer-to-peer networks.
"What differentiates the impact of the code is how successfully they replicate," he says. "In other words, if a program reinstalls itself in a victim's shared drive, it is a better replicator than one that just executes a damaging payload, then expects the victim to manually put the file in their shared file."
The Eightball code doesn't seem to have a very sophisticated distribution mechanism.
So far the major antivirus companies have not addressed this particular trojan. For now, don't search for or download any KaZaA skins named Eightball.
Posted November 26, 2002