New Gnutella worm spreading

[TankGirl]

This little nastie is called Mandragore. From F-Secure:

GnutellaMandragore is a worm which spreads through the Gnutella peer-to-peer file sharing system (which is somewhat similar to Napster). If you're not using Gnutella, you're not at risk. Popular programs to access Gnutella include ToadNode and BearShare.

When a PC gets infected, the worm will connect to the Gnutella network as one node. After that it will monitor what kind of files other people are searching for, and will answer those queries.

For example, if a Gnutella user makes search for "rare pictures of butterflies", the infected node will announce it has available a file called "rare pictures of butterflies.exe", 8kB in size.

If the user downloads and clicks on this file, his machine becomes infected and will start to offer infected files for other users.

Infected nodes easily become overloaded and are unable to answer all requests. So every search does not find infected files although there are infected nodes in the network.

In some cases, infected files are offered without the EXE extension. Such files will fail to execute when doubleclicked but work fine if run from the commandline.

First infected files in the Gnutella network were spotted on Friday the 23rd of February, 2001.

An easy way to avoid infection from this worm is not to download EXE files from the Gnutella network. Some clients (such as BearShare) hide executable files from seach results by default.

For more information, see: http://www.exocortex.org/gnutella/


- tg

[JackSpratts]

thanks for the reminder tankgirl. it's surprising that's it's still a problem because it seems like it's been around forever and it's so easy to avoid. tip: it repeats your search query precisely so incorporate something a bit off in your search (but that won't compromise it's effectiveness) and be very suspicious when it's returned exactly.

example query:

beatles abbey comes The sun

now the suspicious results returned below, 10-12, using gnucleus.

- js.

[assorted]

why are people double clicking on exe files obtained off gnutella? i blame kazza for reintroducing the exe file as "software." even still; i always right click the exe's off kazaa and open with whatever program the self-extractor was based on.

the only problem i ever had doing that was when i somehow corrupted a winace self-extracting when i tried to extract it with winrar. after i did that the file was corrupt for some reason; but i had made a copy and that one opened fine with winace. still; i don't understand why trying to open a self-extracting with the wrong program would corrupt a file...

ok... i'm completely fucking babbling now. please send me to the nursing home.

[zombywoof]

Originally posted by assorted
why are people double clicking on exe files obtained off gnutella?

Thats the problem. Also, lack of updating and using an av to check these files before installing them.