Do not become a zombie for Storm Worm!

By joining our community you will have the ability to post topics and access other forums reserved for members. Registration is quick, simple and absolutely free. Join our community today by clicking here.

Posted: Sun Dec 30, 2007 6:27 am

I'm sure many of you have been receiving these, as have I.

The subject line is:
Happy New Year to you (or something similar)

then followed by a link to one of the the following:

familypostcards2008
uhavepostcard.com
happycards2008.com
newyearcards2008.com
newyearwithlove.com

Please DO NOT CLICK ON THESE as they are the latest Storm Worm Domains.

Baiting Guru Joined: 31 Jan 2007 Posts: 12237

More info here...(No worries, it's safe Wink

) Edit: I meant the link was, not the Storm Worm!

Click

Chuck Norris Joined: 11 Jun 2007 Posts: 1369

Thanks Lotta, I was thinking of starting a thread for this, as my main catcher account has been FLOODED with these the past few days. So I am busy posting away about this on all sorts of different fora.

Looking at the informations on Domain Dossier or Domaintools is. . . interesting. . . as it usually is for these kinds of websites.

Could I add that if anyone gets this and wants to report them, do so here:

http://www.castlecops.com/mirt

Make sure to paste in the full headers along with the link.

Posted: Sun Dec 30, 2007 8:03 am

I didn't get any of those yet. I'm really disappointed...

Posted: Sun Dec 30, 2007 8:11 am

@ Akai

Are they looking for different malware domains or sender's IP address and/or email address?

Posted: Sun Dec 30, 2007 8:17 am

I have a heap of them in one of my baiting accounts. Lucky I haven't clicked any yet.

Thanks for the heads up lotta Smile

Chuck Norris Joined: 11 Jun 2007 Posts: 1369

@ Weasel--

Any relevant information available, obviously this includes the domain itself. Most of the time these things are spammed out by zombie computers already part of that botnet army. So the IP and email addresses of these eCard spams are most likely to be that of compromised Windowz machines, usually home PCs.

Here is an example of how they use information on this thread:

http://www.castlecops.com/posts199857-90.html

Here is a partial list of Storm botnet IPs.

http://spamtrackers.eu/downloads/botnets/storm.db.txt

Posted: Sun Dec 30, 2007 9:32 am

Ok.. TY Akai. Very Happy

Posted: Sun Dec 30, 2007 2:06 pm

How does one tell if one has one of those things on one's computer?

Posted: Sun Dec 30, 2007 2:15 pm

Usually a few hours after the first reports come in the scanners should have updates. Sometimes not yet through the normal update-stream, but through manual updates. Symantec for example has an extra package with the absolutely latest definitions for download on their site (don't remember the name of that package though), which includes definitions not yet included in the live-update.

First try running an online-update of your scanner. If you have a 100% positive file that isn't identified try getting a newer package from the site of your scanner. If then it's still not identified then you might want to consider switching the scanner... Wink

ClamAV, a open-source scanner, has proven to be quite quick with new definitions. Where I worked before it found new stuff often earlier than our highly paid Norton Corporate Edition.

Edit: As for identifying if your system has been infected: Usually sites with virus-info might help here. They usually show what kind of files are created by a virus. Also looking at the list of running tasks might help.
Also there is a nice Task Manager that can show security-threads. But it's payware, and I forgot it's name, but might be Security Task Manager.
Other tools like AVG AntiSpy or Windows Defender might find suspicious stuff running.

Posted: Sun Dec 30, 2007 5:32 pm

I never open those type of emails anyway!

Posted: Sun Dec 30, 2007 8:26 pm

Hekate wrote:

I never open those ... emails ...

Exactly!

As I have posted many times before, I wouldn't open an ecard even if my mother called me and said she just sent one, from Hallmark.

Even some ecard sites are virus riddled and unsuspecting users send their cards out to relatives and friends, not knowing that they may be condemning their computers to a slow death.

I have my personal email account set to "plain text" - no html, no pics, no nothing.

We bait safe, why don't we email safe?

Chuck Norris Joined: 11 Jun 2007 Posts: 1369

Looks like these links are using javascript to auto-execute a file called happynewyear2008.exe which is the Trojan (Peacomm) that Storm drops onto the computer.

Quote:

Your download should begin shortly. If your download does not start in approximately 15 seconds, you can click here to launch the download. . .

Please report these links to Google here as the bad links are showing up first on Google hits:

http://www.google.com/safebrowsing/report_badware/

Posted: Sun Dec 30, 2007 10:47 pm

Too late!

My son opened an email headed something like "here are your holiday pictures" and shazam! The home page then re-set to "Virus Help Zone" and other weird stuff. I'm trying to get rid of the *&@^# thing.

Baiting Guru Joined: 31 Jan 2007 Posts: 12237

Akai Ryu wrote:

Looks like these links are using javascript to auto-execute a file called happynewyear2008.exe which is the Trojan (Peacomm) that Storm drops onto the computer.

And if you are running Firefox. http://www.mozilla.com/en-US/firefox/

This extension will help prevent such nasty things. http://noscript.net/

Both are free, please give them a try. It is like putting a condom over your hard drive.

Posted: Mon Dec 31, 2007 12:47 pm

Thanks for the NoScript tip, Pastor Frank!

@lotta i wouldn�t have opened them anyway, but thanks for this listing.

Posted: Tue Jan 01, 2008 2:35 am

All I get are emails wanting to enlarge my penis....but I am a woman damn it! Thanks for the advance warnings.

Posted: Thu Jan 03, 2008 3:55 am

Pastor Frank wrote:

And if you are running Firefox, this extension will help prevent such nasty things. http://noscript.net/

Agree 100%
It really is a wonderful extension that I've been using it for ages....

Posted: Thu Jan 03, 2008 9:12 am

Chibuike wrote:

All I get are emails wanting to enlarge my penis....

Could you forward one of those to me please..... Embarassed

** ACCOUNT CLOSED ** Joined: 15 Apr 2007 Posts: 766

^^^^The headers are quite long. . . .

Anyways, any experience with this on a Mac?

--J.D.

** ACCOUNT CLOSED ** Joined: 15 Apr 2007 Posts: 766

Question answered.

Seems to work well on a Mac.

--J.D.

Posted: Thu Jan 03, 2008 10:58 pm

Chibuike wrote:

All I get are emails wanting to enlarge my penis....but I am a woman damn it!

I get those all the time too.....and I don't even have a penis! Laughing

Posted: Thu Jan 03, 2008 11:09 pm

Doctor X wrote:

Question answered.
Seems to work well on a Mac.
--J.D.

What do you mean? Does the Mac become infected?

I had a nasty one earlier today when I was googling hotels in Tasmania and a programme ran on my machine telling me that my pc was infected with malware and to download some programme to clear it. However my machine is a Mac and I did not click on the download. I am assuming I am still clean.

** ACCOUNT CLOSED ** Joined: 15 Apr 2007 Posts: 766

Old Coaster wrote:

However my machine is a Mac and I did not click on the download. I am assuming I am still clean.

Sorry for the long response, but I just re-researched a lot of this, and I want to answer your questions.

I just got into another PC versus Mac argument on ANOTHER FORUM [Boo! Hiss!--Ed.] My basic opinion is that people take their preferences, what they are use to, and go with them. Security begins "between the keyboard and user" as some have said. I love to cite an example from a Mac Guru forum where a Newbie screeched about how his Mac "got hacked" and "I thought they were secure!"

Come to find out he refused to set any passwords--Macs tend to do that. Come to find out he did not turn on even the simple firewall or--what most people do with both PCs and Macs--get a better third-party firewall. Come to find out he allowed "File share" and the modalities that encourage computers to communicate with one another. As one guru admonished him, "leave your laptop open, on the ground, turned on, without a password, and OMFG it might get stolen with your data!!"

If you go to an insecure webpage, enter all your personal data . . . OMFG! Identity theft!!!

That having been written, Macs are more secure. Every few months when this argument comes up, I have to search for trojans, spyware, malware, and virae.

There really are none for Macs compared to like a really hugemongeously large number for PCs. "Those Who Know" claim the OS is more secure. Take that claim for what it is worth. One thing that is certain is you, as a user, have to personally allow anything to run on your computer.

Unless . . . you are an idiot, set no passwords, and try to overrun the warnings that "this is the first time you have run this." In fact, researching this reply, I found yet another "trojan finder/malware stopper" program--for purchase of course--which the reviews all reminded that, "hey, the Mac OS already does that!"

BUT the First . . .

There are security updates for threats. This is what I asked about--particularly javascript. Now, what does that mean? I looked over it over the past few months as I read sites like this one and others on security. Mac does patch these, but what does it mean?

I have no fucking clue! I looked it up--in this argument when the PC-Lover claimed Macs have "more t3h thr34ts lolz!11!"--and the data actually shows otherwise. No "Highly Critical" threats.

So, discussing this privately with some people--including a member HERE--I decided to try blocking javascript. While my computer understanding which believes his OS update replaces the 9nome inside the plastic box with cuter and faster piXies does not really understand what happens, apparently the threat exists. Apparently, even the Storm involved Macs?

So why take the chance? I wanted to make sure the "No Script" would work for FF on a Mac.

It does.

The nice thing is it blocks a lot of adcrap that you individually have to block with Adblock--another great resource. You can also set it to allow it by default on pages like this one. Another thing it blocks is third-party cookies and the like. Saves time having to deny each one as I do on my FF.

Does that make my Mac "more t3h s3cur3?"

No bloody idea, but I like the concept!

It does not seem to slow things down. I have an Old Widdle Mac, and if you have a more modern version, I doubt you would notice it.

BUT Part the Seconde:

Despite my searches, there really is not a large or even existent malware or spyware threat. About six months ago, I searched for it--fearing "t3h spy/malware" spewing evil from my Widdle Mac. There is a "search program," but--long story not-so-short--it does not actually find anything but tracking cookies--something that affects both Macs and PCs and you can set to refuse with your browser. You can also clear them.

One reviewer noted that the only keyloggin, "spyware" it finds are those you download yourself to track things--like your kids. It may be a useful program for a shared computer. Otherwise, you are merely trying to remove something you purposely added to your computer!

One of the "malware/adware" programs created purposefully for a Mac as part of a challenge requires you to go through all of the "hoops" to work--you have to choose to download it, you have to choose to open it, you have to choose to load it, et cetera. Well . . . that hardly counts! To my most recent knowledge they has not been a true "malware/spyware"--unless you count a tracking cookie.

Virae? Few and far between. It is better than about a year ago when in the same debate a PC Lover found a Mac virus . . . for System 6!!! Developed years after it was obsolete, apparently.

So Macs win again!

BUT Parte the Third:

This is critical: while the virus, malware, whatever may not affect your Mac--you can pass it to a friend. This I did not know. This is the reason I now have a very good free virus scan--ClamXav. I do not "open" things in e-mails, but I like to be careful.

The other critical thing is that many Mac users run "virtual PC" programs like "Bootcamp." I do not use this since I do not need to. However, apparently many do. When you do this, you make that part of your Mac vulnerable to PC viruses, and the like. This is something Mac users often do not understand to quote the Gurus.

So . . . I, myself, do not know if the Macs involved in Storm were such Macs. I defer to those with better understanding [Just about everyone.--Ed.]

--J.D.

Posted: Fri Jan 04, 2008 3:39 am

Are you a Patriots fan, Dr X? If so, that would explain that wall of text quite a bit... Rolling Eyes

(go Colts!)

Do not become a zombie for Storm Worm!	View next topic View previous topic