New M$ virus affects all versions of M$ Windows?!

Printable View

September 7th, 2002, 03:01 AM
digitalgadfly

New M$ virus affects all versions of M$ Windows?!

There seems to be a new "virus" propagating around out there that they say in not a worm or virus in source code nature. And the method of attack is unknown, all they say is that the attack is automated.

Quote:

Microsoft posted a mysterious alert on its product support services (PSS) page. The alert warns of a hack attack that locks out users, installs backdoor programs, and gives an attacker remote access via IRC.

For some reason this doesn't suprise me. ;) All you can do for now is scan your computer for the certain files that are showing up on "infected" systems.

Quote:

The PSS team says infected systems contain the following files:
Gg.bat
Seced.bat
Nt32.ini
Ocxdll.exe
Psexec
Ws_ftp
Flashfxp
Gates.txt

That is a pretty hefty list of files if you are doing a manual file scan. You can read the whole story here and basically the same article put out by microsoft here .

I was wondering if this has hit anyone on here? All of our boxes are clean, and I have heard no talk of this anywhere.

edit: If anyone has this "virus" on their system I would like to see the files, you know see how it works and try to implement a stronger security policy relating to this.
September 7th, 2002, 03:21 AM
t2k2

I haven't heard of anything of this as of yet. I am sure I will soon. I haven't read the article yet, but maybe our network will be a little safer than some since we don't allow irc to get through the firewall. Who knows? I will definitely have to read this article. Thanks for the info.
September 7th, 2002, 03:39 AM
Alex

Uh-oh.... If MS doesnt give lots of details its no good.... Is there any patch available or is it just Run a virus scan and see what happens
September 7th, 2002, 05:04 PM
omalakai

Breakdown of files

I found a post here where someone did an analysis on the files used in this attack. Specifically, go to the post on Sept 4.

And the "warning" from Microsoft is terrible! Could it be any more cryptic?
September 7th, 2002, 05:23 PM
lobo

MS is always having problem

Waz up, well you say of another MS problem. well if they have not fix it yet there is problem in the (SSL) THAT is letting peeps crack in and put in codes in to banks computers and when the custumers goes to make a transfer the codes that the hacker/Cracker has put in there will make transfers of it's on there was a post about this on antionline but i could not find it agin feel free to look for it.

see ya
September 8th, 2002, 01:03 AM
uraloony

Well, I scanned my comp and I was clean of all files except gates.txt. It was full of IP addies and server listings... Idk what it means. Oh well. :)
September 8th, 2002, 01:47 AM
darkes

I liked this quote as reported by: http://www.wired.com/news/technology...,54942,00.html

In responding to the MS alert, Harlan Carvey, a security engineer with a financial services firm, said:

"It's easily one of the most unprofessional pieces of crap I've ever read. Vague, indirect, doesn't say anything useful at all."

Couldn't have put it better myself :D

P.S. If the MS alert makes any sense at all, I think it is saying that this (whatever it might be) only affects Win2k/XP - not that this really helps much ...
September 9th, 2002, 05:34 AM
powertoad5000

MS have decided that what was originally an unknown form of attack is acutally a mIRC Trojan-Related Attack.

http://support.microsoft.com/default...;en-us;Q328691

Quote:

UPDATE: As of September 6, 2002, reports of malicious activity that follow the particular pattern that is outlined in this article have lessened significantly. The Microsoft Product Support Services Security Team has modified this Microsoft Knowledge Base article to reflect this information and to refine suggestions for detection and repair criteria.

Here is an article which investigates Microsoft's backflip on the 'vulnerability':

http://www.theregister.co.uk/content/55/27007.html

Quote:

So it really does sound like a remote compromise independent of user interaction. Naturally, MS steadfastly refuses to tell us anything useful, like how this is accomplished. 'Install your patches and quit asking impertinent questions' seems to be the subtext here. It's just that I can't quite noodle out how a remote compromise (i.e., one not requiring user interaction) is not a security issue. Perhaps the Redmond spin-meisters would like to walk me through that one.

Anyone surprised? :D
September 9th, 2002, 06:34 AM
Tedob1

how about the way they blame the people that become infected. blaming unpatched or misconfigured servers...damme bitch was asken for it.
September 9th, 2002, 07:23 AM
retoor

Wonder what´s in Gates.txt... Bet it´s funny!
September 9th, 2002, 02:29 PM
uraloony

powertoad PMed me asking for gates.txt. Unfortunately, I have already discarded of it. :( Best I can do is describe what was in it for you. It was a simple text file with many, many IP addresses and servers listed. I am guessing gates.txt is the text file which keeps track of the addresses that the trojan can connect to. Hope this helps! :)

- uraloony
September 9th, 2002, 03:17 PM
cross

Retoor:

some one already said whats in gates.txt...:
"Well, I scanned my comp and I was clean of all files except gates.txt. It was full of IP addies and server listings... Idk what it means. Oh well." posted abouve^
September 9th, 2002, 03:27 PM
mith

Guys,
you are lucky, I had that virus. I cleaned all files and moved them to a safe place. The gates.txt was one of the first I opened, I thought I would have found something funny, but it wasn't. It' another configuration file.

Check out this other thread I had started:
http://www.antionline.com/showthread...hreadid=234448

It's the same virus.
On newbie.org (I saw a previous post about it) they describe it pretty well. I haven't understood how I took it, anyway... The first thing you should notice, if you have it, is that it runs a DOS program at startup, you will see a DOS window opening and closing quickly. If you check your ports you will also find an open port to an IRCd.

Regards,
Mith
September 10th, 2002, 07:55 AM
powertoad5000

MS "solves" mystery of hacking spree

http://zdnet.com.com/2100-1105-957159.html

Quote:

An advisory from the software giant last week warned companies of a number of attacks targeting servers running Windows 2000, the cause of which had initially puzzled Microsoft. After following a trail of evidence left behind on compromised Windows 2000 servers, the company now believes that hackers have systematically exploited Windows 2000 servers that haven't been properly locked down, rather than a hole in the operating system.

Quote:

the software giant didn't explain why every computer attacked happened to be a Windows 2000 server. Insecure password problems affect all computers, not just a single version of an operating system.

Why this stinks:
(1) Still no explanation as to the function of 'gates.txt' - maybe it is just a configuration file - if it's IP addresses, is it possible that it is a list of all the compromised computers?
(2) There were a 'significant' number of compromises, yet it is put down to (a group of?) hackers... how many is 'significant'?
(3) From Mith's post, it sounds more like a virus/worm than a trojan that one has to use manually - that's just my n00b opinion.

Am I paranoid, or is there some merit to these ideas? What do you guys think?
September 10th, 2002, 10:11 AM
mith

To me, it's a DoS attack script. I opened all files, there are a couple of executables: taskmngr.exe (the real prog) and mdm.exe (to hide execution of taskmngr.exe) and also psexec.exe that is needed to start the others.
All the other files *.dll and *.hlp are all mIRC scripts to join channels, list other clones and send attacks to remote PC's.

I'm at work now, I had the virus on my home PC, but I can tell you that I saw some lines in which, the attacker, could send a command on the public channel and the BOT would attack a remote host. There's even the syntax help that tells the attacker that he forgot the remote host IP or similar things.

There's also a strange file with a HUGE list of nicknames (typical IRC standard, such as TheUnd3rtak3r and so). When I got on IRC I searched for a few of those, but I couldn't find any.

Oh, another funny thing is that the default nickname for the BOT was a simple nick, something like "The_cute_one", but then there's a line to generate a random nick. When I got on IRC I searched for "The_cute_one" and was online.. He didn't answer my messages and I couldn't see in which channel he was, of course.

If gates.txt is so interesting to the group, I can paste it.

Something you might care about, also, is that the script tries to catch your wp_ftp and flashfxp password file, it copies them into c:\winnt\system32 and notifies the channel of your local IP (and saves it into one of the .ini files).
Luckily I have a dynamic IP on my DSL, so I simply needed to turn off and on my router. ;)

Laters,
Mith
September 10th, 2002, 11:07 AM
mrleachy

gates.txt?
doesnt that sorta ring a bell? what about internet Gate(ways), they would most likely have static ip's, maybe it is some form of worm that is similar to code red a few months back?

just an idea, im not sure if it seems feasible to any of you guys though...
September 11th, 2002, 02:39 PM
MrLinus

mrleachy was on track. A little poking about found this: http://vil.nai.com/vil/content/v_98936.htm

It doesn't surprised me that this so called "New M$ Virus" seems to been infecting servers although all could be affected. And poor password management is a valid reason, IMHO. When look at what was infecting the machines (older trojans and viruses -- this one here dating back to the fall of 200) you have to wonder if the administration is perhaps being lax in their antivirus updates and general administrative duties.

Perhaps if some of those admins had done a little visit to google or other places they might have found their answers.
September 12th, 2002, 11:35 AM
Und3ertak3r

Quote:

There's also a strange file with a HUGE list of nicknames (typical IRC standard, such as TheUnd3rtak3r and so). When I got on IRC I searched for a few of those, but I couldn't find any.

That would be right.. the-bloody-und3rtaker I wouldn't trust someone with that sort of nick..
would you??

Cheers

(Sry for wasting the space on this one)
September 12th, 2002, 07:11 PM
Sgt_B

MsMittens: Poor administration had a heavy hand in this scenario, but how would you explain that Windows 2000 servers are the only affected servers.

Quote:

However, the software giant didn't explain why every computer attacked happened to be a Windows 2000 server. Insecure password problems affect all computers, not just a single version of an operating system.

Taken from PowerToad's link here.

Like the article says, if this was only a weak password issue, then wouldn't we be seeing this same thing on all windows platforms not just 2000?
September 12th, 2002, 09:42 PM
MrLinus

Let me ask you this: which will have more "valuable" info and more power? A Windows 98 Machine, Windows 95, Windows 2000 Professional or Windows 2000 Server?
September 12th, 2002, 09:53 PM
Sgt_B

Well server of course! :D

What I got from the article was that the problems were found on windows 2000 server machines exclusivley. If this is the case don't you think that other windows machines would be compromised? I'm sure many script kiddies out there could care less if its a server or not, they'd just like to compromise a machine....server or not. I just think its odd that this would be seen predominantly on 2000 servers. NT servers weren't mentioned as victims either.

It just seems really odd to see something like this, where 2000 servers were the only targets. Usually, if it can be done on another windows platform, then it will be done.

Just my thoughts on it.