|
Peer to Peer The 3rd millenium technology! |
|
Thread Tools | Search this Thread | Display Modes |
23-08-02, 10:23 AM | #1 |
Join Date: Mar 2000
Posts: 2,160
|
Worm spreads through KaZaA network, again
For those of you who use kazaa. I don't use it myself, but here is some info for those who do.
Virus watchers have discovered the latest in a line of viruses targeted at file sharing networks. The Duload worm is spreading across the KaZaA file-exchange network, antivirus firm Kaspersky Labs warns today based on reports of infections from Italian internet users. Duload appears as a Windows executable written in Visual Basic either 18432 bytes or, in its compressed form, 7680 bytes in size. If the infected file is accidentally opened "Duload" copies itself to the Windows system directory under the name "SystemConfig.exe" and modifies the system registry so that this file automatically loads each time Windows is started. Next, the Duload worm creates a folder in the Windows directory called "Media" and copies itself to this directory under 39 different names, explained in more detail in Kasperky's advisory. Duload then once again modifies the system registry in order to make the Media folder accessible to all other KaZaA network users, with the aim of furthering its spread. One modification of the worm also downloads from the Net several Trojan programs designed to establish the unauthorised remote management of victim computers. Antivirus vendors are in the process of updating their tools to detect the worm. As always, the main advice remains to be vigilant about the possibility of downloading and running executable code from file sharing Web sites. File sharing services are increasingly becoming a target for virus writers. In June, KaZaA users became exposed to a virus called Backdoor.K0wbot.1.3.B, which followed the infection of the network by Benjamin worms only a month earlier. ® article: http://www.theregus.com/content/55/26080.html Last edited by zombywoof : 23-08-02 at 11:52 AM. |
23-08-02, 12:00 PM | #2 |
Join Date: May 2001
Location: New England
Posts: 10,024
|
thanks oscar.
- js. |
23-08-02, 12:43 PM | #3 |
Apprentice Napsterite
Join Date: Aug 2002
Location: Germany
Posts: 88
|
i steel think that newsgroups and or irc is the way-to-go but kazaa is nice too...however this is like the third virus in what? 3 months? do these viruses just propagate automatically or do they have to be executed?
the article on the antivirus website didn't say. thanks, -kento |
23-08-02, 01:41 PM | #4 |
Registered User
Join Date: Jul 2002
Posts: 275
|
Most viruses (or trojans) have to be executed but I'm not sure about this one.
|
24-08-02, 06:24 AM | #5 |
Registered User
Join Date: May 2002
Location: NL
Posts: 107
|
All trojans/worms/viruses for Kazaa have (and probably will) use the same approach to spreading:
- you download the worm thinking it's something else - you are stupid enough to execute it - the worm copies itself to several dozen filenames that seem attractive to stupid Kazaa users - the worm makes the folder it copied itself to available to the Kazaa network by writing it to the Registry where Kazaa looks for folders to share - rinse and repeat So if you have a virusscanner that's up-to-date: don't worry. |
24-08-02, 07:37 AM | #6 | |
Apprentice Napsterite
Join Date: Aug 2002
Location: Germany
Posts: 88
|
Quote:
|
|
24-08-02, 09:54 AM | #7 |
Registered User
Join Date: Jul 2002
Posts: 275
|
What's up, Kento!
|
26-08-02, 10:05 AM | #8 |
Bumbling idiot
Join Date: Feb 2002
Location: Vancouver, CA
Posts: 787
|
Duload not to be confused with the perfectly legitimate DUMeter.
|
27-08-02, 08:54 AM | #9 | |
Registered User
Join Date: Mar 2002
Posts: 45
|
classic!
Quote:
This is the critical step. This is where all viruses would cease to exist if people could avoid doing this!! |
|
28-08-02, 04:12 PM | #10 | |
Registered User
Join Date: May 2002
Location: NL
Posts: 107
|
Re: classic!
Quote:
|
|
Thread Tools | Search this Thread |
Display Modes | |
|
|