Printable View
Well, I think Denial-of-Service is a bigger problem than both. DoS is much easier to execute then virii. One thing to bear in mind is that virii are used mostly by crackers whereas spyware is used by inscrupuolous advertisers for the most part. Most virus coders nowadays use Visual Basic, as opposed to ASM like they used to. Just an interesting trend.....
I think spyware is worse.
not in damage systemwise or economicly. But a virus is yust something that damages is most
of the cases. Spyware and stuff like that violate my privacy, slow down my computer(I'm a gamer performance is everything), create network traffic thus steal bandwith(although virii do also).
And most inportant, spyware and adware and things like that are being developped by company's
who choose to do so. We are not talking about some skiddy with a new script. We are talking about someone making a profit out of this stuff. And then when it has been develop another company or site goes and uses this stuff. Again that is a choice to do so and it's not like there playing with it or some 13 year old kid that wants to see what happens when he DDoses yahoo.
It gives me the creeps.
-MoonWolf
Actually thats only because the boxes that are in play have already been compromised. The reason why dDoS is even possable is because why? Well usually because of worms/trojans on computers first of all which aid in dDoS attacking for starters. Visual Basic, as opposed to ASM like they used to?
Actually if you hang around a few VX boards and read a few e-zines you'll find that there are MANY peaple still into assembly. You could maybe make a worm or virus in VB, sure. But it sucks when you need to create a dropper that checks for runtimes, if they aren't around then install them before droping your trojan or (ect).
To Undertaker, the email you gave seems to not be working. I sent it twice and nothing. Email me back with either another email or try to give it to me again. I typed exactly what you gave me before. I'll wait till then to resend it.
grim_reaper1.. Last email i recieved.. you asked for my email addy.. I take it you have not recieved my reply? that from my yahoo account?
I will send an alt addy
cheers
PM'd the addy.. 1 min after the original post of this reply..
I hope you didn't title them "Banged in the Back Seat" they were the most popular mails removed from the bulk mail folder..on Yahoo..
just for the record.. the first address.. undertaker_0_2 at yahoo dot com
hey Soda.. you getting bored?
Got a back log of PC's with various Malware and user problems
Oh yeh: bigest virus I used to have .. was "usr.IDtenT.xxx" .. normaly noticed after the user cleared some hdd space, or removed some unwanted programs.. or the good ol "somtin is fill'n me hdd" when the user thinks that removing the Start menu entries is the deletion or removal of progs..
GR.... mcgoo32 at yahoo dot com
others can email to confirm its existence, if you're bored.
Hey were's my reply, i've been waiting and waiting and still no reply.Quote:
GR.... mcgoo32 at yahoo dot com
others can email to confirm its existence, if you're bored.
That's false advertisement, i wanted confirmation that it existed.
Me still waiting.
cheers
f2b:.
Dude, why'd you have to do that? you know... put all those spaces there?? It's kind of annoying ;).
So what's the latest news?? Did he send the "infected" pics??? If so, is it legit?
Moonwolf, your absolutly right, im a gamer myself, performance is everything! lol.
Hey front ta back... you didn't send nuttin... :p
Grim... yeah im bored
GR.. recieved your .jpeg, and it nothing happened. No changes to my system, just a error, with 3 different picture progs... including fax viewer. Maybe you can hint us to the symptoms? It sounded like it would crash... :p
Opening the file in notepad as well gave me some juicy keywords.
Thats some text I was able to pull out of the file. The "binder" was written is the leetest language ever, VB. I think its called DRR, or somethingQuote:
This program must be run under Win32
CODE DATA ÀPD BSS À.idata À.tls À.rdata P.reloc P.rsrc kernel32.dll DeleteCriticalSection LeaveCriticalSection EnterCriticalSection InitializeCriticalSection VirtualFree VirtualAlloc LocalFree LocalAlloc GetCurrentThreadId GetStartupInfoA GetModuleFileNameA GetLastError GetCommandLineA FreeLibrary CreateDirectoryA ExitProcess WriteFile UnhandledExceptionFilter SetFilePointer SetEndOfFile RtlUnwind ReadFile RaiseException GetStdHandle GetFileSize GetFileType CreateFileA CloseHandle user32.dll GetKeyboardType MessageBoxA CharNextA advapi32.dll RegQueryValueExA RegOpenKeyExA RegCloseKey kernel32.dll TlsSetValue TlsGetValue LocalAlloc GetModuleHandleA kernel32.dll GetWindowsDirectoryA GetSystemDirectoryA DeleteFileA CopyFileA CompareStringA user32.dll CharUpperBuffA shell32.dll ShellExecuteA UTypes ÇSystem SysInit ¸untPos KWindows +untExtras yFrEaK_ReadWrite This program cannot be run in DOS mode.Rich PE .text.data À.rsrc MSVBVM60.DLLBKPs DRR Form1 DRR 2004 Form1 TahomaD Command1 Text1 Welcome to DRR 2004An unknown error has now occured in order to remove this error then please restart your computer.
Image1 D : \ M y P r o g r a m s VB5 DRR Drr 2004 DRR D:\My Programs\Darkside\DRR 2004\Project1.vbp
Network\ SRemoteAccess\ ControlPanel\AppEvents\Config\Hardware\System\.DEFAULT\Display\PSystem\CurrentControlSet\Control\Update\,ControlPanel\Colours\*RemoteAccess\Profile\0Software\Microsoft\IEAK\ Software\Yahoo\JSoftware\Microsoft\InternetExplorer\.Software\Microsoft\IE4\HSoftware\Microsoft\InternetDomains\\Software\Microsoft\InternetConnectionWizard\ Software\Kazaa\ SOFTWARE\KAZAA\HSoftware\Microsoft\MessengerService\@Software\Microsoft\MSNMessenger\$Software\Symantec\$SOFTWARE\Symantec\4Software\Microsoft\Office\ Software\Adobe\ SOFTWARE\Adobe\>Software\Microsoft\MediaPlayer\`System\CurrentControlSet\Control\Print\Printers\xConfig\0001\System\CurrentControlSet\Control\Print\Printers\BControlPanel\Appearance\Schemes\4Software\Microsoft\Telnet\@Software\Microsoft\TelnetServer\DSoftware\Yahoo\AudioConferencing\*Software\Yahoo\Pager\6Software\Yahoo\YFriendsBar\.Software\Yahoo\YServer\xSoftware\Microsoft\Windows\CurrentVersion\Policies\Explorer\lSoftware\Microsoft\WindowsNT\CurrentVersion\Policies\ Network\Logon\__vbaStrToAnsi__vbaOnErrordSYSTEM\ControlSet001\Services\RemoteAccess\Policy\$SOFTWARE\Policies\$Software\Policies\tSoftware\Microsoft\Windows\CurrentVersion\Policies\System\VBA6.DLL__vbaFreeStr__vbaSetSystemError__vbaFreeObj__vbaHresultCheckObj__vbaObjSetAddref__vbaNew2˜v@ä£@
Error"HKEY_CLASSES_ROOT"HKEY_CURRENT_USER$HKEY_LOCAL_MACHINEHKEY_USERS*HKEY_PERFORMANCE_DATA&HKEY_CURRENT_CONFIGHKEY_DYN_DATABTheRegistryDatabaseiscorrupt!BadKeyName Can'tOpenKey Can'tReadKey8Accesstothiskeyisdenied Can'tWriteKeyOutofmemory"InvalidParameter|Thereismoredatathanthebufferhasbeenallocatedtohold..UndefinedErrorCode:\
HKEY_"IncorrectFormat:__vbaVarAdd__vbaStrVarMove__vbaVarCmpEq__vbaVarCmpNe__vbaVarOr__vbaBoolVarNull__vbaInStr__vbaErrorOverflow__vbaStrCat__vbaStrCmp__vbaStrCopy__vbaFreeStrList__vbaStrI2__vbaAryUnlock__vbaAryLock__vbaVarForNext__vbaStrMove__vbaUI1I2__vbaGenerateBoundsError__vbaI4Var__vbaVarForInit__vbaRedim__vbaLenBstr__vbaVarCopy__vbaVarMove__vbaFreeVar__vbaFreeVarList__vbaStrToUnicodeMSVBVM60.DLL__vbaStrI2_CIcos_adj_fptan__vbaVarMove__vbaFreeVar__vbaLenBstr__vbaStrVarMove__vbaFreeVarList_adj_fdiv_m64_adj_fprem1__vbaStrCat__vbaVarCmpNe__vbaSetSystemError__vbaHresultCheckObj_adj_fdiv_m32__vbaVarForInit__vbaOnError_adj_fdiv_m16i__vbaObjSetAddref_adj_fdivr_m16i__vbaBoolVarNull_CIsin__vbaChkstkEVENT_SINK_AddRef__vbaGenerateBoundsError__vbaStrCmpDllFunctionCall__vbaVarOr_adj_fpatan__vbaRedimEVENT_SINK_Release__vbaUI1I2_CIsqrtEVENT_SINK_QueryInterface__vbaExceptHandler__vbaStrToUnicode_adj_fprem_adj_fdivr_m64__vbaFPException_CIlog__vbaErrorOverflow__vbaInStr__vbaNew2_adj_fdiv_m32i_adj_fdivr_m32i__vbaStrCopy__vbaFreeStrList_adj_fdivr_m32_adj_fdiv_r__vbaI4Var__vbaVarCmpEq__vbaAryLock__vbaVarAdd__vbaStrToAnsi__vbaVarCopy_CIatan__vbaStrMove_allmul_CItan__vbaAryUnlock__vbaVarForNext_CIexp__vbaFreeObj__vbaFreeStrVS_VERSION_INFO½ïþDVarFileInfo$Translation °€StringFileInfo\040904B0,CommentsDRR2004(CompanyNameDRR4ProductNameDRR2004,
FileVersion2.000
ProductVersion2.00(InternalNameDRR8OriginalFilenameDRR.exeDRR.exe
Any thoughts, GR?Quote:
Welcome to DRR 2004
:D
edit-
stuff attached.... supposedly a virus, open at risk
Hmm...that's a pretty hard question. If we're talking within the context of the question, and the question only, then i would have to say that i consider virii as a more dangerous threat to users. Isnt it sometimes a virus can also act as spyware in some sense? Like when it sends information from the infected computer to a remote terminal, in some ways, that alone is already an act of spying...similar to what spyware would do. Well, at least that's my view... :) Of course, each one of us has different views and opinions this this is a highly debatable topic... ;) I've read through the other replies though, and i believe that most if not all also have merit...like i said, this is a highly debatable topic. :rolleyes:
hey soda..
there is a DRR Software company who have a DRR Basic. can't answer the VB6 calls
cheers
Hi Folks,
IT IS A VIRUS!!!
Well it is an attempt at one:
"PictureCrash.JPG is
Win32.Interlaced.10.B.Dropper"
I am afraid it did not survive the electrified fence, led alone get smothered in a sandpit or fall into the jaws of the rabid pack of script stranglers.................and the rest of the gang are still asleep in the bunker :D
The virus appears to be new, as the AV only spotted the dropper mechanism................as an aside, it did not let me download UPX (the actual packing tool) the other day, so I guess the AV is looking for "tools & mechanisms", as well as patterns and behaviour.
It is e-trust (Vet?) the mob that Microsoft bought.
I will now have to try to download it onto a labrat, as the ARV will obviously have nothing to do with it.
Nice One! very interesting...............but I am going to have more work to try to get it to infect ........I am thinking of loading a collection of picture viewers and editors onto the labrat?
Cheers for now
EDIT: I just had a quick scroll through the .txt version and saw this:
SOFTWARE\Borland\Delphi\RTL FPUMaskValue
I wondered why it seemed so bloated, and I do not see any evidence of an actual picture there, so I am suspecting a "social engineering" approach and a circumvention of the usual double extension "giveaway".......................but how to get it to run? that is the question.
So now we have the virus and we have some info about it and its a new type of virus attack. With this information in mind, how much at risk is the internet community?
Both are big problems, of course. But spyware has become way more popular than the old-fashioned virus. Viruses are effective, no doubt. When it comes to control and power like most hackers want, they turn to spyware and/or trojans.
I just wanted everyone to be aware that this was not bullshit. The original picture may not have been such a good choice, and I can always try to resend this, but again, my ISP is blocking certain things right now, and may have a problem doing so. Yes, the original malicious part of this is named DRR, but if you Google it as I have, all you get is the company. I have not found the program anywhere, and DRR company is not it. Yes, the binder prog was Interlaced 2, it allows you to bind a host file with a hidden file that is malicious. Sorry to Undertaker whose emails were blocked by my ISP.
I can't remember where I got the origianl DRR file from, but I did download it and have it saved on disc for future ref. The Interlaced 2 prog I also dl'ed and again, can't remember where from. I do know it wasn't from anywhere big like Sub7 or Hacktivismo, or CultDeadCow. If I remember, I will let the community know.
Hmmm,
I think that it is a virus or an attempt. I think that a part of it is VB and probably the core is Borland Delphi, not sure about the rest of it, as I am waiting to get my hands on it...........on the labrat.
What I do not see is how opening an image file (single extension) will actually launch the executable?
My particular query is that image files probably have the greatest variety of default launching programs, as you seem to get a fresh one with each digital cam, web cam, photo manipulation package etc?............?
Any thoughts?
Blah... Windows95, with regprot, and a few other programs monitoring startup methods... many are my own creation it would be very hard disableing those. Ran it and took a look into it through a more NT based enviroment. Ran it... and under as many image viewers as I possably could. Nada NOTHING... Took it appart with WDASM you all can sort through it better with that. The only thing related to images and this file as far as I can tell is its own damn goofy icon. Sure it might be malware but from the looks of it its just a *.exe renamed and given another file exstension.
i think spyware is more of a problem, virii can mess ur comp up, but just the idea of those spyware companies knowing my secret gay kiddie porn habits is frightening :eek:. j/k :D
Phonedog911
Quote:
"Well... what can you expect from a slave-banging, Hitler-loving, queer like Thomas Jefferson?"
errrr.................FIVE THOUSAND DOLLARS?
:cool:
Here it is ppl. Have at it. One thing:
[gloworange]OPEN AT YOUR OWN RISK. I ACCEPT NO LIABILITY [/gloworange]
If this is a virus what does it do?
I mean i don't understand half of it but looking at the code,
it should popup a window with some text asking to restart computer. And then do stuff with regkey's.
But I don't understand enough assmbler to figure out wat it does.
And the picture does not work. Not on my home comp using 6 picture viewers and faxviewer.
and at school tried it in win 98, 95, me, nt4, 2000 all using the same 6 viewers and knoppix 3.2. with no result (no real suprise).
So I think the binding stuff is crap. Unless someone else did manage to make it work. Or the virus can hide itself REALLY wel, but i don't think that's it because it should pop up a window.
grim_reaper if it really is supposed to work tell us what it's does and how you tested it.
I would say they were both equal. Some that were spyware before are now counted among the viruses and they are still out there. One is Sir Search. I remember when it was just spyware. Look at what they do now. Highjack your browser. Sir Search also has the Flow Go Bar which is their spyware. So I guess what I am trying to say is that Sir Search is both spyware and a virus.
well now i'm brand new to this site, and its actually spyware that brought me here. and just the amount of ppl that are trying to hack into systems. it amazes me (and of course alot of them are bring viruses with them, i just had to bring my computer back to its original state because of infections in my registry from spies). so i've been fighting with the evil aol about how safe am i with their protection? well they assure me - oh i'm safe - well i've got their (aol)version of mcafee virus protection and firewall. its ok, but i'm still not sure. and i'm really irritated (don't like aol or mcafee) because with my aol 'firewall' - the technology of it is as good as a bought mcafee wall, but i can't sent out info on ip addresses of ppl trying to get in or block them (well i can block them, but have to go into my system to do it)......just new to this whole scene and i'm like obsessed with it....its bad out here...