quote:

Ikatako is a virus that spreads through Japanese P2P network Winny, aided by the pirates' lack of wit. Once downloaded and run, the virus sends their data to a central server and replaces it with cephalopod and cnidarian imagery.

BorderPatrol posted:

jet_dee posted:

Holy poo poo. How would a Mac user find out if they are infected or not?

quote:

This article was updated to remove erroneous information concerning Mac OS X. The OS is not vulnerable to the crimeware kit.

ymgve posted:

Maybe not so notable, buut:

http://yro.slashdot.org/article.pl?sid=10/08/15/0512228

Zwabu posted:

So what does it mean if a co-worker had a bunch of Viagra spam emails go out with her email address as the sender to all of her contacts?

Her level of tech savvy is so low she couldn't even tell me if she used a program like Microsoft Outlook to read her email, on questioning it sounded like she just does it through her web browser but I couldn't be too confident of her answers. I suggested to her that a lot of malware likes to do stuff like use an Outlook contact list to send out its spam but I'm not sure what the most common specific causes are.

ymgve posted:

Define "go out with her email". Are you seeing the actual emails sent from her Outlook? If not, it might be the case that a spammer has selected her address at random to use in the "from" field. This happened to a domain I own, the spammers for some reason picked randomword@mydomain.com which isn't even a real account on my system, and the catch-all at my domain got thousands of bounce mails in return.

Zwabu posted:

This had occurred to me, but she said the emails went out to her actual contact list. That implies more than just her email address being used, the spambot/malware had to get her contact list somehow didn't it? With something like Outlook that would be easy, but I'm not sure how it works if you just use webmail.

ymgve posted:

I also got a download dialog for an .asx file, but that obviously didn't infect anything.

Midelne posted:

Yeah, ASX never has exploit-related issues.

As usual, there's always a good possibility that you were hit by a single infected ad rather than the specific website that you're associating with the infection. The ad may have been identified and taken out of rotation or it might just not be coming up on the specific times that you're visiting the site.

Detroit Q. Spider posted:

So how ugly are these customers? Obviously MSE found and dealt with them but who knows how long they were sitting on my machine. Thanks Java!

Zwabu posted:

This had occurred to me, but she said the emails went out to her actual contact list. That implies more than just her email address being used, the spambot/malware had to get her contact list somehow didn't it? With something like Outlook that would be easy, but I'm not sure how it works if you just use webmail.

BillWh0re posted:

TDL3 now has a 64-bit variant that infects the MBR instead of an existing driver.

http://www.kernelmode.info/forum/viewtopic.php?f=16&t=19&start=370

This will be interesting to follow since with Patchguard MS removed many of the tools anti-rootkit software uses to detect and remove things. The ball is really in their court to stop Patchguard being bypassed.

Until then you can probably remove it really easily with fixmbr or some other boot CD solution. Easier than 32-bit TDL3 at least.

COCKMOUTH.GIF posted:

I have a system here that I've been scanning and cleaning. It's Vista 32-bit and I believe it had some variant of the fake antivirus malware going around. It looks clean for the most part. Every scanner I toss at it comes up clean, but when I run GMER, it crashes when it reaches the point where it scans what appears to be the volume on the hard disk. I'm thinking it has an MBR infection but it's hard to say. Are there any tools to determine this for sure or should I just use something like the Microsoft Vista Recovery disk to run a FIXMBR? Or maybe Microsoft DaRT?

MiddleNotch posted:

Oh, and the computers gonna be nuked and reloaded, since there is no fix for it. Not even google can find it.

Any ideas what it is though is what I am asking?

Midelne posted:

The nuking and reloading is probably a decent idea anyway, but you could just remove it from the list of things that open on startup with msconfig if it hasn't removed access to it. You didn't mention any access restrictions, which means this is probably going to be trivial to remove either manually (delete the profile's Temporary Internet Files and Temp files, use the msconfig Startup tab to find out where the programs live, uncheck them, kill the processes, delete the files, run a Find in the registry to look for entries pointing to appropriate filenames or newly-created folders and delete the keys, etc) or automatically with MalwareBytes or something.

It's not really relevant, honestly, but when you say that it's "scanning" a range of ports, do you mean that it's listening on those ports locally (netstat -a) or that it's actually scanning those ports on other systems on the network? If it's listening on local ports, then that makes it sound more like it's backdoor of some kind waiting to be told what to do with the system.

It sounds very poorly written and the reason you're most likely not finding a specific fix for it is that it's a piece of junk that isn't good enough at spreading to come up on anyone's radar.

MiddleNotch posted:

It is tricky though, even deleting the keys and .exes it still comes back making me think it is a rootkit, or I am not looking hard enough for it.

Midelne posted:

GMER is a good first stop when you suspect that you're rooted in Windows.

One other non-root way to replicate the behavior of putting itself back together once you've deleted it would be to change the file associations for .exe and such. Might take a look to see if those are intact, but if you're having substantial difficulty after MalwareBytes and GMER it's probably gone past the point of being too annoying to bother with and should probably just be wiped.

MiddleNotch posted:

By unresponsive I mean, when you click on the start button it kicks you out to the login screen. When you relogin the only things you can click on and run are on the desktop. Using shortcut keys reboots the system. Safe mode doesn't work.

quote:

atapi.sys bluescreen.

Midelne posted:

I ran into somewhat similar behavior when I'd manually removed a trojan that set itself as the default handler for .exe and various other files. Every time Windows attempted to run something, bad things happened.

The proper course of action at this point is wipe/reinstall after retaining vital documents and cat pictures, but I'd probably just keep poking at it if there's no deadline. If you can still use context menus, then a right-click, create shortcut, cmd.exe would give you command shell access and allow you to happily traverse the file system.

From there, you mentioned that you had access to the task manager, but command line equivalents for some of the same functionality would be tasklist to list running processes nice as you please and tskill once you have the process number from tasklist to end a process. tasklist /svc may also give you a somewhat deeper perspective on what is actually running in terms of services and what those mysterious svchost.exe processes are being used for.

That said, if GMER and the other are finding root-like processes running, it's entirely possible that you wouldn't even be able to see the questionable code without lateral measures. If you want to dig a little more with the available data, look for broad patterns in the GMER results (is it all coming from the same folder?), boot the system from a Backtrack or other live CD that can handle NTFS, and take a look at those folders from outside of the existing Windows installation.

Mind you, this is purely for poking-at-things-is-fun value. If you're rooted, then the existing installation of Windows can never be trusted again and will need wiping.

MiddleNotch posted:

edit: windows sees the partition as "undefined". Repair console says go to hell when trying to fix it. Good luck to you guys when you come across this thing.

Midelne posted:

Use something other than Windows to take a look and see if you get a different result.

Syphilicious! posted:

So yesterday, the Antivirus Vista 2010 virus infected my computer. I ran Malwarebytes in safe mode, and it got rid of it. However, now, anytime I try and run a program, it says a few variations of things. When I try and run iTunes, for instance, it says iTunes.exe cannot be found. The same thing for Modern Warfare 1 and 2, and anything that had a shortcut on the desktop. A few programs, IE 7, for instance, will make me select which program to use to run it. When I select IE 7 from the list, it doesn't really open up. At least Firefox still works. This also appears to have affected a lot of other programs. iTunes, at least, runs when I select 'Run in Administrator Mode'. So does a few other programs. But it really isn't worth the hassle. I made a new account on the computer, and everything is working fine on that one, but my main one is still hosed up.

What can I do to fix this? Is it not worth the hassle?

Ted Stevens posted:

Well, the system is trashed. Just backup what you can and reinstall windows. The Dell discs work with any Dell branded computer.