| Wednesday,
September 13, 2000 Hollywood Bowl last night. Mendelsohn
concerto by 18 year old Ilya Gringolts conducted by Itzhak Perlman. Now
THAT was a combination! Extremely well done, as you'd expect.
I have got to grind on my O'Reilly hardware book, but yesterday Niven
came over and we worked on Burning Tower. Good scenes.
VIRUS ALERT
This has not got widespread publicity. And I sure have it and had it
for quite some time.
On Windows 98 and Windows ME (and probably Windows 95) machines, check
the size of NOTEPAD.EXE. DO NOT OPEN NOTEPAD until you check that file
size. If that is larger than 60K and you have a file called note.com
or note.exe on your system then you have a worm.
Use startup manager to see if your system automatically runs NOTEPAD on
startup. If it does, stop it, that is NOT NOTEPAD. It sends an email to
China. Whatever else it does it does that.
USE TASK MANAGER to STOP NOTEPAD which may be running although you
didn't tell it to. (Closing the program won't shut this down.) Use STARTUP
MANAGER to prevent NOTEPAD from opening on startup. DELETE NOTEPAD (if
it's larger than 100K and rename NOTE.COM to NOTEPAD.EXE and stay tuned
for more messages.
Have a look at this site:
http://www.datafellows.fi/v-descs/qaz.htm
ALEX has mailed the following: (HE writes faster than I can)
This information is current as of 9/13/00, 1730
Hours PDT. This is a personal message from Alex Pournelle, and contains,
to the best of my ability to determine, a serious and not-well-understood
threat to Windows 9X computers and probably other Windows variants as
well.
Re: "QAZ" trojan
Dear everyone:
PLEASE PROPAGATE THIS INFORMATION AS QUICKLY AS
POSSIBLE, BUT INCLUDE THE PROVISO THAT THIS INFORMATION IS BOTH TENTATIVE
AND NOT AUTHORITATIVE. WE DO NOT KNOW HOW WIDESPREAD THIS PROBLEM IS, AND
THE POSSIBILITY EXISTS THAT THIS IS SOMEHOW A FALSE CONCLUSION ON OUR
PART.
We have just discovered what appears to be a sneaky
and infective new virus, which is propagated by a new method as yet not
understood. ALL machines running Windows 98 and ME are at risk and NO
VIRUS CHECKING SOFTWARE we have tried detects it at this moment.
Short version: If your NOTEPAD.EXE is larger than
about 52K, and it is being run on startup, YOU ARE INFECTED. NOTE.EXE,
also present, is the original version of Notepad. We do not yet know about
its propagation method or harm. Use Startup Manager, not MSCONFIG, to
check for this program executing at startup. Check for a NOTE.EXE, which
will probably be the unharmed version of the original application. Check
for a file association of ".HSQ", which appears on several of
the affected machines.
Information from the current alert as we understand
it BEGINS:
On Windows 98 and Windows ME (and probably Windows
95) machines, check the size of NOTEPAD.EXE. DO NOT OPEN NOTEPAD until you
check that file size. If that is larger than 60K and you have a file
called note.com or note.exe on your system then you have a worm.
Use startup manager to see if your system
automatically runs NOTEPAD on startup. If it does, stop it, that is NOT
NOTEPAD. It sends an email to China. Whatever else it does it does that.
USE TASK MANAGER to STOP NOTEPAD which may be
running although you didn't tell it to. (Closing the program won't shut
this down.) Use STARTUP MANAGER to prevent NOTEPAD from opening on
startup. DELETE NOTEPAD (if it's larger than 100K and rename NOTE.COM to
NOTEPAD.EXE and stay tuned for more messages.
Symptoms apparently include sending an email to
somewhere in China.
END OF ALERT
This apparent virus/trojan was discovered by Robert
Ransom while on-site at Chaos Manor less than an hour ago, as of 1730
hours PDT 9/13/00.
Important information will be contained at www.jerrypournelle.com
, my father's website, and will doubtless be followed by other sites.
PLEASE PROPAGATE THIS INFORMATION AS QUICKLY AS
POSSIBLE, BUT INCLUDE THE PROVISO THAT THIS INFORMATION IS BOTH TENTATIVE
AND NOT AUTHORITATIVE. WE DO NOT KNOW HOW WIDESPREAD THIS PROBLEM IS, AND
THE POSSIBILITY EXISTS THAT THIS IS SOMEHOW A FALSE CONCLUSION ON OUR
PART.
Check the usual virus sites. As of this writing,
there has been NO news about this at the usual sites, including ICSA. The
ONLY reference to this trojan is via the "Northern Lights"
search engine as of this writing.
More to follow, Alex Pournelle
Alex Pournelle, Director, PC and LAN Practice,
Tech/Knowledge (www.t-k.com) VP Business Development, TK Media Services (www.locationconnect.com)
(800) 818-TECH or (626) 844-1000
OK. Here is the situation. Every machine at Chaos Manor had the
phoney NOTEPAD.EXE file. The dead giveaway is that the file is over 100K,
while Notepad is about 50 - 60K if it's real. EVERY machine. I will come
back to the implications of that shortly.
However, none of my machines seemed to be infected in the sense that
the worm was running. To activate the worm you must start Notepad, and I
hadn't done that on any 98 or ME machine; and on NT and 2000 machines this
thing doesn't seem to take hold.
If you run Notepad, several things happen. First, it opens note.com
which is in fact your old Notepad renamed. Next, it tells the registry to
run notepad on startup. Finally, it goes resident, and closing notepad
does not close this thing at all. To get rid of this you must run Task
Manager.
I deliberately allowed one of my systems to be infected with this thing
by running a known corrupted copy of Notepad. "I do all these silly
things so you won't have to..." The result was much trundling.
I got rid of it by closing Notepad with Task Manager, then using Startup
Manager to stop it from running on startup. Then I renamed note.com to
NOTEPAD.EXE.
When it does run it seems to seek out every machine on your local
network. I found copies of it on SPIRIT, an ancient server running NT 4
and strictly used as an application file storage system. It was there. It
was on every one of my Windows 98 machines. It was on Roberta's machine
and it made Notepad work VERY Strangely; removing it and renaming took
care of that.
I am not sure what the purpose of this is, or how I got it, or how it
managed to put itself on all my machines. It's possible that a machine
brought here and hooked up to my network had it, and that infected all the
others.
We can't find how we got it, and it's fairly easy to get rid of, but
it's there. BEWARE.
For more see mail. ALso,
Roland has found a bit more about "our Chinese friend".
And it was on ALL Machines, including portables. What I have done is on
every machine in the house I search for note and see what happens. Then I
sort by size in the search returns. If I see a file larger than 100K it
will generally be an infected Notepad. Kill it -- you can do that right
from the search result -- and if it will not die then it is running in
background. Use ctl-alt-del and Task Manager to shut it down, erase the
file (or move it to an isolation ward), rename note.com to NOTEPAD.EXE and
you should be all right. It's not a particularly vicious thing, but it
will muck up the way Notepad works, and it does upload something to China.
We aren't through taking it apart yet.
My thanks to Robert Ransom who noted that his disk drives were churning
when running Notepad and found this monster,
See also
http://www.symantec.com/avcenter/venc/data/qaz.trojan.html
TOP
|
