Catch up on stories from the past week (and beyond) at the Slashdot story archive

 


Forgot your password?
Close
typodupeerror
×
Security Worms IT

Kama Sutra Worm Could Make For A Bad Friday 317

Posted by Zonk from the batten-the-hatches-tie-down-the-sails dept.
mikey1134 writes "CNN is running a story about the Kama Sutra worm, a virus that is coded to overwrite files of the (potentially thousands of) infected computers. They provide some background on this viral outbreak and warn users to protect themselves" From the article: "And even for home computer users who have never taken such precautions before, security experts say now would be a good time to back up your most important data, like financial information and family photographs, to CDs, DVDs, zip drives, or an external hard drive that you know is worm and virus free. Unlike a lot of malware that exploits vulnerabilities in the Windows operating system, there is no 'patch' that can be downloaded to ward off Kama Sutra."
This discussion has been archived. No new comments can be posted.

Kama Sutra Worm Could Make For A Bad Friday More

Kama Sutra Worm Could Make For A Bad Friday

Comments Filter:

  • Many Aliases and More Info (Score:5, Informative)

    by eldavojohn ( 898314 ) * <eldavojohn@noSpAM.gmail.com> on Thursday February 02, 2006 @12:15PM (#14626528) Journal
    For references, these are the enumeration names and where to go to make sure you have the latest anti-virus signature [mitre.org]. Remember, this variant will uninstall and delete most anti-virus software so it's important to recognize it before it goes active tomorrow. Most virus definition software refers to it as CME-24. This is important since this worm has many different names including Nyxem.E, BlackWorm, Grew and Mywife.E.

    More on the worm [sans.org] and its permutations and statistics on spreading.

    A very detailed analysis [lurhq.com] with all types of files that may be affected.

    And, if it's worth anything to you, the Microsoft advisory [microsoft.com] which seems to tout that Windows Live Safety Center Beta [live.com] can protect against it. If you're in charge of computer security at your workplace, I would send out an e-mail instructing everyone to verify that they have the correct anti-virus definitions and to scan their computers before leaving tonight. Luckily, that's not my job where I work.
    • like totally unhelpfull..I didnot understand a word of your post or the links

      Surely, there is a simple answer to this question:
      if i scan my hardrive tonighte with avg or macafee or norton, am i protected ?
      where do i download the patch ?

      if not, this surely demonstrates that the protection companies aint worth a tinkers damm

      • Re:Many Aliases and More Info (Score:5, Informative)

        by rkrabath ( 742391 ) on Thursday February 02, 2006 @12:34PM (#14626746) Journal
        >> if i scan my hardrive tonighte with avg or macafee or norton, am i protected ?

        Possibly yes, but also possibly not. This virus wil disable many common AV programs. My reccomendation would be to use a specialized scanner such as the one from f-secure: http://www.f-secure.com/v-descs/nyxem_e.shtml [f-secure.com]. I just used that one myself.

        • I would think one of the best solutions (along with backing things up) is to turn the system clock back a few days, until a proven removal tool can be used.

        • Re:Many Aliases and More Info (Score:5, Informative)

          by Inda ( 580031 ) <slash.20.inda@spamgourmet.com> on Thursday February 02, 2006 @01:26PM (#14627380) Journal
          I know you're only trying to help but to answer the GP's post again.

          Probably yes. That's a big 99.9% yes...

          Yes, the Worm tries to delete anti-virus program files. Yes, tries to stop anti-virus software running at reboot. But if it's managed to do that, there's no way you're scanning your PC tonight anyway.

          Update your definitions and scan now. Inform everyone you know not to open email attachments they weren't expecting.

          Which brings me to another point: Do people really get hit with these anymore? It won't make it though all the major webmail services. You haven't been able to open *.PIF or *.SCR files in Outlook for years now. You almost have to go out of your way to get infected by email worms these days.

          Don't get caught up in the media hype. This isn't another Blaster.

      • Re:Many Aliases and More Info (Score:5, Informative)

        by j-cloth ( 862412 ) on Thursday February 02, 2006 @12:35PM (#14626758)
        McAfee DATs 4642 [mcafee.com] and higher will catch it.
      • >where do i download the patch

        You don't -- there isn't one. This does not exploit a vulnerability in the OS. It exploits a vulnerability in those willing to click email attachments.

      • Re:Many Aliases and More Info (Score:3, Funny)

        by Anonymous Coward
        Surely, there is a simple answer to this question:
        if i scan my hardrive tonighte with avg or macafee or norton, am i protected ?
        where do i download the patch ?

        I just emailed it to you. Click on the attachment to open it.

    • Re:Many Aliases and More Info (Score:4, Funny)

      by muszek ( 882567 ) on Thursday February 02, 2006 @01:32PM (#14627433) Homepage
      [cut!] enumeration... [cut!] the latest anti-virus signature... [cut!] CME-24. ... [cut!] Nyxem.E, BlackWorm, Grew and Mywife.E.... [cut!] permutations ... [cut!] detailed analysis ... [cut!] advisory ... [cut!] Windows Live Safety Center Beta ... [cut!] security ... [cut!]

      Nah, nobody needs that voodoo stuff. The virus only overwrites files of certain types. All you need to do is to turn off "show file extensions" option in Explorer to totally confuse the virus ;)

      Sorry if I confused that option's name... I haven't touched a windows box in a while.
    • ...so it's important to recognize it before it goes active tomorrow.

      Timezones people... it was already 5 hours into "tomorrow" for New Zealand when you posted that message.

      Apparently I'm not infected.. but then, I don't go around opening unsolicited attachments.

  • Obligatory Kama Sutra Comment (Score:4, Funny)

    by sumi-manga ( 948999 ) on Thursday February 02, 2006 @12:16PM (#14626540) Journal
    Better back up that pr0n too! :P

  • Your computer... (Score:5, Funny)

    by bondsbw ( 888959 ) on Thursday February 02, 2006 @12:18PM (#14626554)
    ... really should have more flexible security.
    • There really is no reason to use the standard file names if you're just keeping the files within your system(s).

      You can renamed ".doc" to any non-standard name and not have to worry about virii like this deleting them.

      For a larger organization, it's just a matter of changing filenames, file associations and perhaps most importantly: make sure the icon transitions with the name change.

      It might be a PITA, but there's nothing simpler than security through obscurity. Anything you do to change the behavior of th

  • Write-once backups (Score:5, Insightful)

    by truthsearch ( 249536 ) on Thursday February 02, 2006 @12:18PM (#14626555) Homepage Journal
    The best backups are those written to only once. Burn to a write-once only CD or DVD. Don't back up to an external hard disk. As soon as you plug it in anything can happen, either from Windows itself or from malicious software (redundant, I guess).

    In the old days we backed up to tape and flipped a switch so the tape couldn't be overwritten. Today it's burn-once disks. Don't trust anything but physical protections from disk writes.

    • Re:Write-once backups (Score:5, Funny)

      by TubeSteak ( 669689 ) on Thursday February 02, 2006 @12:25PM (#14626641) Journal
      In the old days, we etched our words into stone tablets for safe keeping..

      A destructive virus was when a sick person would start coughing so hard that they'd break tablets by knocking them over.

      The cost of physical media was high & the write speed was slow. Back then, we went to a lot more effort to make sure that our backups stayed safe.
      • In the old days, we etched our words into stone tablets for safe keeping.

        A destructive virus was when a sick person would start coughing so hard that they'd break tablets by knocking them over.

        The cost of physical media was high & the write speed was slow. Back then, we went to a lot more effort to make sure that our backups stayed safe.

        You forgot "And we were grateful!"

      • Re:Write-once backups (Score:5, Funny)

        by Anonymous Coward on Thursday February 02, 2006 @02:49PM (#14628344)
        I remember those days. There was this guy called Moses who had received some seriously important data on top of some mountain. He goes down the mountain, and he breaks the tablets. He didn't make backups, so he had to go back to his client and ask for a new copy of the data. Very embarrasing.

        That should serve as a warning to everyone; always make backups. Especially with important clients like that.

    • Re:Write-once backups (Score:5, Insightful)

      by charlesnw ( 843045 ) <charles@knownelement.com> on Thursday February 02, 2006 @12:31PM (#14626714) Homepage Journal
      You evidently don't have a lot of data to backup. My nightly backups are almost half a terabyte. If I didn't reuse media, I would have a very hard time getting my budget approved. Media isn't cheap. 100 tapes is $10,000.00. Write once is nice but doesn't work in real life. Unless you have small amounts of data that fit on one TAPE or DVD. And if you have to store your backups (we have to store offsite for 7 years) you would be paying 2 arms and 3 legs in storage and handling fees.
      • I've worked on large systems, including a multi-terabyte "data warehouse". No matter how big every system can get nightly incremental backups to save space. There is no way EVER you should be overwriting any previous backup. If you have that much data, and it's that valuable, you pay for whatever it takes to make every backup written once-only. Buy a set of drives or one drive with a large multi-disk feeder and pop in 100 7 Gb DVDs every night. Or better yet only do an incremental every night and a ful
        • For liability reasons I recommend exactly the opposite. Always do backups to destroyable media. Do media descruction runs after specific periods (3 yrs, 5yrs, 7 yrs, whatever applies to the information in question) and keep the media safe in the mean time.

          For nightly backups, much of that data is only valuable if one copy is available. Do a full backup cycle or two and then start overwriting media. No need for last month's data (except the "month-end" backup), its out of date now.
          • Always do backups to destroyable media.

            All media is destroyable. There are shedders that can easily handle disk platters, CD-ROMs, DVDs, etc. The shedders are smaller versions of circuit board shedders that have been common to firms doing defense electronics since the 1950's.

        • Maybe you haven't worked with companies having fewer than 100 billion dollars in assets; but I provide software and services to credit unions and I assure you, they cannot afford to use a SLDT 320 GB tape once and archive it forever. The monthlies are (if they follow our recommendations) put away indefinitely, but that's about it. There is a reason to reuse tapes, and it's called "practicality." They couldn't open their doors to teenagers and low-income families if they had to do what you demand.

      • Re:Write-once backups (Score:3, Informative)

        by bored ( 40072 )
        My nightly backups are almost half a terabyte..Media isn't cheap. 100 tapes is $10,000.00

        What I was saying was that LTO-3 stores 400G uncompressed, the tapes are less than $70 and the drives are less than $2500. Sounds like its time for you to buy a new tape setup.

    • You can always unplug a removable hard drive.
      • And when it's time to restore something do you not plug it in? What's the point of writing to a disk you can never safely read from?

        Your response is something one of my old PHBs would have said.

  • Oh yes, this (Score:5, Insightful)

    by voice_of_all_reason ( 926702 ) on Thursday February 02, 2006 @12:18PM (#14626561)
    This is the virus that MS has a patch from their fancy new Remote System Control program, right? Simply agree to download and blindly run any code they decide to send, let 'em take a peek at what you're running from time to time, and send regular status reports to the nice windows home base -- and then, we'll protect you from the nasty viruses!

    And remember, kids... that's a nice computer. Would be a shame if something were to "happen" to it, you know what I mean?

    • Re:Oh yes, this (Score:4, Funny)

      by jayhawk88 ( 160512 ) <jayhawk88@gmail.com> on Thursday February 02, 2006 @12:56PM (#14627036)
      And remember, kids... that's a nice computer. Would be a shame if something were to "happen" to it, you know what I mean?

      I'm sorry, our records indicate that this joke was used no less than 17 times in yesterday's thread [slashdot.org] about this same topic. You are in violation of the Stale Internet Joke Act of 2004. Please refrain from any and all AYBABTU references and report to UseNet for remedial training immediately.

    • Oh leave off it (Score:5, Insightful)

      by Sycraft-fu ( 314770 ) on Thursday February 02, 2006 @01:43PM (#14627573)
      There's no patch because it's not a vulnerability, it's a virus. The only thing you can patch is the users that still won't follow directions and not open executable attachments. The OS is working as intended when it executes code you ask it to, which is how this virus gets on.

      This "OMG MS won't patch t3h systems!!!11" stuff on Slashdot is getting old. No, they won't patch it because there's nothing to patch. Duh. They have decided to add it to the malicious software tool, which is a mini virus scanner akin to Stinger from Mcaffee, which scans for a limited subset of viruses, but that's not a patch. Windows OneCare, which is NOT a remote control system by the way, does find it because, well, it's a virus scanner just like any other. It catches it just like AVG, F-Secure, Norton, and so on, which is to be expected as it's a competitor.

      So let's leave off the bullshit ok? There are two easy methods to prevent this from hurting your system:

      1) Don't run random programs that some with e-mails. If you use Outlook Express, it'll even tell you not to (twice).

      2) Get a virus scanner. Doesn't need to be MS's, there are many good ones out there. I recommend AVG, it's fast and free.

      • Re:Oh leave off it (Score:3, Interesting)

        by sootman ( 158191 )
        "Don't run random programs that some with e-mails. If you use Outlook Express, it'll even tell you not to (twice)."

        Super. That will take care of it. </sarcasm>

        I use OWA and this is next to every single attachment: "Attachments may contain viruses that are harmful to your computer." Gee, thanks. When users see that next to every single word doc, PDF, and JPEG they get on a daily basis, they start ignoring it. If everything is a threat, nothing is a threat.

  • But but but we want a patch!!! (Score:5, Informative)

    by Siberwulf ( 921893 ) on Thursday February 02, 2006 @12:19PM (#14626572)
    "Unlike a lot of malware that exploits vulnerabilities in the Windows operating system, there is no 'patch' that can be downloaded to ward off Kama Sutra."

    Half the articles i read yesterday about this said that the public was being screwed over becuase MS wouldn't release a patch.

    The only patch for stupid is a swift boot in the ass.
    • Actually, this virus might BE the "patch" for stupidity.

      "Hey, what happened to all my documents?"

      "You opened a pr0n attachment in your email, you just got what you deserved."

      "Boy, I'll never do that again!"

      So, if these idiots are capable of any learning at all, this might work out to be a good learning experience for them. And if they're not, well, hey -- it's not my problem they're stupid.

    • As far as I know, this is not a windows vulnerability. Users are just stupid and will open any executable with the word "kamasutra" in it. Make it a .desktop file and you have the equivalent linux virus...

  • Patch? How about a brain patch! (Score:5, Funny)

    by Sporkinum ( 655143 ) on Thursday February 02, 2006 @12:19PM (#14626573)
    Unlike a lot of malware that exploits vulnerabilities in the Windows operating system, there is no 'patch' that can be downloaded to ward off Kama Sutra.

    How about a stupidty patch for opening up an attachment like the one described.
    • I liked how in the article itself it said "There is no patch for user error." I call it removing their Banzai Buddy and smacking them upside the head with a keyboard.

    • Don't I wish (Score:5, Funny)

      by Sycraft-fu ( 314770 ) on Thursday February 02, 2006 @01:49PM (#14627643)
      Here's my idea:

      We setup a room. The door to the room says, in every language "Danger! Do not enter". Inside they'll be a cage you need to open, again with keep out warnings. Inside the cage will be a button that says "Warning: Do not push the button, death will result!". If you push the button, you die. We come in once a week or so and clean out the body.

      My guess is any person likely to push the button is also the kind that'll open random attachments despite being told not to by us, the OS, their virus scanner, etc.

      Problem solved :D

  • Better yet... (Score:2, Insightful)

    by Anonymous Coward
    ...transfer your important data to a new hard drive inside of a Mac.

  • i have a patch (Score:5, Funny)

    by tehwebguy ( 860335 ) on Thursday February 02, 2006 @12:24PM (#14626627) Homepage
    just turn your computer off before midnight, and leave it off until saturday.

    • Re:i have a patch (Score:3, Insightful)

      by xlyz ( 695304 )
      you can do better:

      turn you pc to an other os and leave it on tomorrow as well
      • Right, because that's fantastic advice for the type of people who click on unknown attachments in their emails...

        Congrats, you use Linux. It's be great if more people did, perhaps. But now you're just jerking yourself off, and it doesn't seem particularly helpful.

  • Zip drives? (Score:5, Funny)

    by Dr. Sp0ng ( 24354 ) <mspongNO@SPAMgmail.com> on Thursday February 02, 2006 @12:25PM (#14626630) Homepage
    ...to CDs, DVDs, zip drives, ...

    What is this, 1996?

  • Strange... (Score:5, Funny)

    by casualsax3 ( 875131 ) on Thursday February 02, 2006 @12:25PM (#14626643)
    Anyway I like how virus names are slowly getting edgier. Kama Sutra is a good one, but it'll be great fun when someone names a virus the Angry Dragon, Cleavland Steamer, or the Dirty Sanchez. I eagerly await the day when the words "Rusty Trombone hits America hard" grace CNN's frontpage :)

  • Hmm (Score:4, Funny)

    by voice_of_all_reason ( 926702 ) on Thursday February 02, 2006 @12:29PM (#14626683)
    As bad as this day? http://images.amazon.com/images/P/0689711735.01._S CLZZZZZZZ_.jpg [amazon.com]

    //mah favorite book

  • Clue About How To Detect Whether You're Infected (Score:5, Informative)

    by Fleetie ( 603229 ) on Thursday February 02, 2006 @12:33PM (#14626731) Homepage
    This URL would seem to provide some hints about how to check whether you're infected.
    It mentions some registry keys that the worm sets up.

    http://www.sophos.com/virusinfo/analyses/w32nyxemd .html [sophos.com]
  • After checking up on the virus through some of the links in the article...frankly, I would be surprised if most readers of Slashdot were affected. I thnk most Slashdotters are way too smart to engage in the sort of behavior (opening suspicious email attachments) that is necessary to allow infection.

    I feel sorry for all the people who aren't, though.

  • Go Ask Alice (Score:5, Funny)

    by RobertB-DC ( 622190 ) on Thursday February 02, 2006 @12:43PM (#14626863) Homepage Journal
    From TFA:
    "So while you might think it is coming from cousin Alice, most likely cousin Alice is not going to send you something that says 'Hey look at these pictures with naked people.' So that should be your first clue that a virus is propagating and you'd be well served to call cousin Alice to let her know that she is [unknowingly] sending out this type of e-mail," Sergile said.

    Mr. Sergile, you obviously haven't met my cousin Alice [alicecooper.com].

  • Searches Network Shares (Score:4, Interesting)

    by ObsessiveMathsFreak ( 773371 ) <obsessivemathsfreak.eircom@net> on Thursday February 02, 2006 @12:45PM (#14626889) Homepage Journal
    This one will be more damaging than people think.

    A lot of SMEs uses unsecured and passwordless network shares for sharing company data. Data that is stored in, you guessed it, *.doc *.xls, etc, etc files. This virus looks for shared drives such as this and will corrupt the files on them tomorrow.

    If only one PC in the company is effected, I can see a whole lot of sore heads tomorrow at lunchtime.

    I guess I should have paid more attention to this one.

    • Re:Searches Network Shares (Score:4, Informative)

      by Feebleminded_Genius ( 950911 ) on Thursday February 02, 2006 @02:49PM (#14628343)
      Agreed. I've been chasing this down on our corporate network all week.

      I installed this virus on a test network last night. It was ugly to say the least. The test network was comprised of 5 clients, 1 DC, and 1 file server. When I ran the email attachment on a client, it immediately froze, consistent with the description on F-Secure. Upon rebooting with monitoring on, it launched numerous processes, and disabled Symantec immediately. Within 4 hours it had infected the other 4 clients & the file server.

      We then flipped the switch on the DC & set the date to 2/3/06. Update.exe launched half an hour after login, and within 4 hours all .docs, .xls, .mdb files etc were corrupt on the local machines and the file servers.

      Note that this test was performed with out-of-date virus defs as a test.

      Here's an idea for those in a corporate environment. Create a software restriction policy for the executables associated with the virus:
      %systemroot%\system32\scanregw.exe
      %systemroot%\system32\update.exe
      winzip quick pick.exe
      winzip_tmp.exe

      We did this in our test environment and it halted the virus completely.
  • "Unfortunately, there is no way to patch user ignorance, and the way this virus propagates is through user ignorance,"

    Isn't the purpose of this article to patch user ignorance?

    If I were more creative, and funnier, I would come up with many witty and similar analogies to the phrase "patching user ignorance." :-)

  • Anyone else calling in sick tomorrow? (Score:4, Funny)

    by digitaldc ( 879047 ) * on Thursday February 02, 2006 @12:53PM (#14626996)
    I feel a sudden illness coming on, could be a virus.

  • CME-24 aliases, information, and removal tools (Score:5, Informative)

    by Futurepower(R) ( 558542 ) on Thursday February 02, 2006 @12:58PM (#14627066) Homepage
    Here's how to know the difference between a money-making press release, and an honest story: The press release says "Fear, fear, fear!!!"

    The honest story gives you links to tools for eliminating the threat: You can run this tool: W32.Blackmal@mm Removal Tool [symantec.com], which apparently removes all variants of the worm.

    Here are manual instructions: WORM_GREW.A, Also known as: CME-24 [trendmicro.com]

    Here is the list of names of the CME-24 worm, and links to removal methods: CME-24 aliases, information, and removal tools [mitre.org].

  • Ok guys, seriously there's an easy answer. (Score:3, Insightful)

    by jonfields ( 643711 ) on Thursday February 02, 2006 @01:38PM (#14627520)
    Step 1: Go into Date and Time properties Step 2: Click on Internet Time tab Step 3: Uncheck Automatically Synchronize Step 4: Click on Date & Time tab Step 5: Change the date to the 4th (saturday) Step 6: Click OK Step 7: Wait until it really is saturday and turn automatically synchronize back on. I'd reccomend this for everyone, whether you think you have it or not, just to be on the safe side.

  • Clamav (Score:2)

    by Ween ( 13381 )
    I have tried to find out if clamav will detect this virus with no positive results. Does anyone know the status?
  • "There is no 'patch' that can be downloaded to ward off Kama Sutra."

    That's right. Once you get the Kama Sutra, you're fucked!
  • Our users have had it pounded into their heads never to open attachments on messages with odd subjects.

    But I'm just waiting to see who the pervs are. This should be interesting when someone comes to me and says their files have been deleted. Hmmmm.. and what were you trying to look at.
  • The article states that the virus executes on the third of this month (tomorrow.)

    Why not just wind back the clock?

    I'm serious. I've fooled many a shareware program that locks the program after x days by setting the date back to when I first installed it (or even earlier, which makes for some funny notices.)

    Unless the Kama Sutra virus is programmed in such a way as to store the date and time installed, and then keep track of every (milli)second that's past, and execute once enough seconds have passed to put

  • Am I safe? (Score:4, Funny)

    by Arandir ( 19206 ) on Thursday February 02, 2006 @03:20PM (#14628660) Homepage Journal
    I'm using FreeBSD, am I safe? I think I am, but with all the panic swirling around over this issue, I'm not sure. Some guy just ran past my cubicle screaming, "no one is safe!"

Slashdot Top Deals

Understanding is always the understanding of a smaller problem in relation to a bigger problem. -- P.D. Ouspensky

Close