Macro and script viruses dying off
Results 1 to 3 of 3

Thread: Macro and script viruses dying off

  1. #1
    Senior Member cwk9's Avatar
    Join Date
    Feb 2002

    Macro and script viruses dying off


    The good: Macros virus are less common
    The bad: There's lots of Spyware and trojans to take its place

    The end of standard mass mailing worms is nigh - maybe as soon as before the end of 2003. But their replacements - Trojans and Spyware - are much, much worse.

    Or so Roger Thompson, technical director of TruSecure, a risk management firm, forecasts. In particular he warns of the risk from Remote Access Trojans (RATs) or backdoors posted on the Net or spread via email.

    "Malware code writers will continue to disguise RATs and backdoor scripts as 'adult' movies and then post them to pornography new groups targeting inexperienced users," he writes. "Expect them to continue through 2003 but they will be mixed with more and more grey ware (i.e. spyware and advertising monitoring that is barely legal)."

    Thompson notes mass-mailing Windows viruses were largely unsuccessful in hitting corporations in 2002, with the notable exception of organisations which did implement proper filters. One of the two biggest worms of the year was Klez, which infected home PCs mostly.

    Macro and script viruses emerged at a rate of 200 to 300 a month in 2002 but this will decrease to approx. 20 to 30 per month, TruSecure believes.

    According to Thompson, the impact of the mass-mailing worm is mostly over for corporations but it will still have an impact on SOHO (small office/home office) environments this year.

    Code Red
    TruSecure (and more particularly its affable "Surgeon General" Russ Cooper) came to notice in 2001 for predicting that the Code Red virus had the potential to "meltdown" the Internet.

    This warning was, we now know overstated. Cooper told us, when we met up with him before Christmas, that he did not regret the warning. He was acting, he said, on early analysis of Code Red and its possible spread through NT4 boxes. This turned out to be a lesser risk than first believed.

    Fair enough; but TruSecure is still banging on about Code Red-style attacks to this day. Thompson warning he expects "another attack in 2003 in the class and level of Code Red".

    If he means another outbreak of hysteria from sectors of the security community (which ought to know better) over some supposed Internet-crushing threat, how could we disagree?
    Its not software piracy. Im just making multiple off site backups.

  2. #2
    Senior Member
    Join Date
    Feb 2002
    well it's true Macro viri are seen less these days.. but I got this from intelligentx newletter

    Macro Virus On The Loose

    Antivirus software company Symantec is warning of a new macro virus targeting Microsoft Word.

    The virus can overwrite the Master Boot Record (MBR) of any physical hard drives on a computer.

    Dubbed W97M.Killboot, the virus infects a currently active document and the template when an infected document is closed. Any documents will be infected when they are closed.

    But it also creates the file C:\Setver.exe, which the Symantec antivirus products detect as Trojan.Killboot.

    If Trojan.Killboot is run, it writes the viral code into the MBR which can then overwrite the MBR on all physical hard drives with zeroes.

    So far there have been few reports of the virus in the wild.
    ah.. just to dbl-check.. I found the orginal article from vnunet

  3. #3
    Now, RFC Compliant! Noia's Avatar
    Join Date
    Jan 2002
    ppl are learning that they shouldn't open unknown's evolution
    the stupid get fryed, and only the smart survive.

    - Noia
    With all the subtlety of an artillery barrage / Follow blindly, for the true path is sketchy at best. .:Bring OS X to x86!:.
    Og ingen kan minnast dei linne drag i dronningas andlet den fagre dag D landet her kvilte i heilag fred og alle hadde kjrleik elske med.

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts