PDA

View Full Version : New bot about to spread on the 'net


YeOldeStonecat
03-19-04, 06:03 AM
http://news.com.com/2100-1009_3-5175025.html?tag=nefd_top

"A new malicious computer program has been detected that can create networks of remotely controlled computers to take part in online attacks, send junk e-mail messages and engage in other shady activities common to the bad neighborhoods of cyberspace.

The program, known as phatbot or polybot, uses technology like that developed for file sharing networks such as Gnutella and Kazaa to control the machines. ("Bot" is shorthand for "software robot," a term generally applied to automated software.)

Once the program has made its way onto a victim's computer, it spreads across networks and searches for passwords that are stored on hard drives and are passing across local networks. It also disables antivirus programs and systems for upgrading software security."




Ahh...going after P2P users such as Kazaa again. Now if only they'd destroy Kazaa and other P2P software users, and leave the rest of us alone.

Travlin_Man
03-19-04, 06:09 AM
Thanks for the heads up YOS..

I just got done helping a couple of friends get rid of the W32/protoride worm (MSUPDATE.EXE) and it was a bitch. So keep your eyes open for that one also.

YeOldeStonecat
03-19-04, 01:30 PM
First day, already on Symantecs list.
http://securityresponse.symantec.com/avcenter/venc/data/w32.hllw.polybot.html

qball15j
03-19-04, 01:41 PM
I heard about that on TechLive last night. The freaky part is the whole password grabber thing. Last night they said they didn't know how to stop it so we'll see what happens.

YeOldeStonecat
03-19-04, 01:45 PM
Originally posted by qball15j
I heard about that on TechLive last night. The freaky part is the whole password grabber thing. Last night they said they didn't know how to stop it so we'll see what happens.

Yeah, I feel better about it after reading Symantec description..it's using DCom/RPC vuln's as one of the methods...so no worries there (assuming one is prudent and did those cricial updates last year)

qball15j
03-19-04, 01:49 PM
Originally posted by YeOldeStonecat
Yeah, I feel better about it after reading Symantec description..it's using DCom/RPC vuln's as one of the methods...so no worries there (assuming one is prudent and did those cricial updates last year)
Yeah, I hear ya...

Shinobi
03-19-04, 02:26 PM
I'll tell ya... it's only a matter of time, before we all see some sort of hybrid "super worm"...
I'm thinking of making a custom "Live Linux" cd, that loads into memory only... might be good to surf the web with that, in case of a "big" wan type , worm problem in the future....
Be Happy,
Shinobi

CableDude
03-19-04, 07:11 PM
Thanks for the heads up.

hayc59
03-19-04, 08:10 PM
thank you for the info!!