Author Topic: AIM Worm  (Read 9333 times)

0 Members and 2 Guests are viewing this topic.

Offline RoMi

  • x86
  • Hero Member
  • *****
  • Posts: 502
  • gg no re
    • View Profile
AIM Worm
« on: October 03, 2005, 04:27:43 pm »
(21:08:04) *NAME*:  how do i look http://ip/~tashreba/pic1253.com
(21:08:21) *NAME*:  how do i look http://ip/~tashreba/pic1253.com
(21:08:49) *NAME* logged out.
(21:09:19) *NAME* logged in.
(07:03:29) *NAME*:  how do i look http://ip/~tashreba/pic1253.com
(07:03:54) *NAME* logged out.
(15:05:05) *NAME* logged in.
(15:09:56) *NAME*:  how do i look http://ip/~tashreba/pic1253.com

My friend got it, seems a lot like Newby's MSN Worm.
« Last Edit: October 03, 2005, 07:00:42 pm by RoMi »
-RoMi

Offline Newby

  • x86
  • Hero Member
  • *****
  • Posts: 10877
  • Thrash!
    • View Profile
Re: AIM Worm
« Reply #1 on: October 03, 2005, 05:10:14 pm »
I wonder if this thing installs a webserver on the victim's box... I swear this thing has more hosting than anything I've ever seen.
- Newby
http://www.x86labs.org

Quote
[17:32:45] * xar sets mode: -oooooooooo algorithm ban chris cipher newby stdio TehUser tnarongi|away vursed warz
[17:32:54] * xar sets mode: +o newby
[17:32:58] <xar> new rule
[17:33:02] <xar> me and newby rule all

I'd bet that you're currently bloated like a water ballon on a hot summer's day.

That analogy doesn't even make sense.  Why would a water balloon be especially bloated on a hot summer's day? For your sake, I hope there wasn't too much logic testing on your LSAT. 

Offline RoMi

  • x86
  • Hero Member
  • *****
  • Posts: 502
  • gg no re
    • View Profile
Re: AIM Worm
« Reply #2 on: October 03, 2005, 05:45:15 pm »
Now hopefully there is a way to remove this, since he is my friend I'd like to help him out.  If anybody finds anything about removal please post it here.
-RoMi

Offline Ergot

  • 吴立峰 ^_^ !
  • x86
  • Hero Member
  • *****
  • Posts: 3724
  • I steal bandwidth. p_o
    • View Profile
Re: AIM Worm
« Reply #3 on: October 03, 2005, 06:52:45 pm »
I've never seen it. I don't click links from strange people. Pictures that end in .com... lol :P. Commen sense is so the best defense! And uhh... you should disable those links (If they are real)... so someone doesn't accidently unleash it on themselves :O.
Who gives a damn? I fuck sheep all the time.
And yes, male both ends.  There are a couple lesbians that need a two-ended dildo...My router just refuses to wear a strap-on.
(05:55:03) JoE ThE oDD: omfg good job i got a boner thinkin bout them chinese bitches
(17:54:15) Sidoh: I love cosmetology

Offline Quik

  • Webmaster Guy
  • x86
  • Hero Member
  • *****
  • Posts: 3262
  • \x51 \x75 \x69 \x6B \x5B \x78 \x38 \x36 \x5D
    • View Profile
Re: AIM Worm
« Reply #4 on: October 03, 2005, 07:37:43 pm »
There have been COUNTLESS AIM trojans. Google it for a fix, there's actually another topic on these forums where Towelie mentioned this. Not a worm, by the way.
Quote
[20:21:13] xar: i was just thinking about the time iago came over here and we made this huge bomb and light up the sky for 6 min
[20:21:15] xar: that was funny

Offline iago

  • Leader
  • Administrator
  • Hero Member
  • *****
  • Posts: 17914
  • Fnord.
    • View Profile
    • SkullSecurity
Re: AIM Worm
« Reply #5 on: October 03, 2005, 07:45:57 pm »
There have been COUNTLESS AIM trojans. Google it for a fix, there's actually another topic on these forums where Towelie mentioned this. Not a worm, by the way.

It's technically a worm in the same way that mydoom and such are worms.  There is a pretty blurred line between worms and other malware these days. 

It would be nice if you left the correct ip, just put a space somewhere so the link doesn't work (and it takes effort to get infected).. that way I could download it, scan it, and figure out what it is. 

Offline Quik

  • Webmaster Guy
  • x86
  • Hero Member
  • *****
  • Posts: 3262
  • \x51 \x75 \x69 \x6B \x5B \x78 \x38 \x36 \x5D
    • View Profile
Re: AIM Worm
« Reply #6 on: October 03, 2005, 08:38:23 pm »
There have been COUNTLESS AIM trojans. Google it for a fix, there's actually another topic on these forums where Towelie mentioned this. Not a worm, by the way.

It's technically a worm in the same way that mydoom and such are worms. There is a pretty blurred line between worms and other malware these days.

It would be nice if you left the correct ip, just put a space somewhere so the link doesn't work (and it takes effort to get infected).. that way I could download it, scan it, and figure out what it is.


It's self-replicating, assuming this one spammed the buddy lists by itself, but usually these things are malicious files that are sent with a harmless link as disguise, aka trojan.
Quote
[20:21:13] xar: i was just thinking about the time iago came over here and we made this huge bomb and light up the sky for 6 min
[20:21:15] xar: that was funny

Offline iago

  • Leader
  • Administrator
  • Hero Member
  • *****
  • Posts: 17914
  • Fnord.
    • View Profile
    • SkullSecurity
Re: AIM Worm
« Reply #7 on: October 03, 2005, 08:46:17 pm »
A trojan is something with a malicious payload piggybacked on an innocent looking program (kinda like Spyware). 

Offline Newby

  • x86
  • Hero Member
  • *****
  • Posts: 10877
  • Thrash!
    • View Profile
Re: AIM Worm
« Reply #8 on: October 03, 2005, 09:12:01 pm »
http://70.84.54.154 /~tashreba/pic1253.com
« Last Edit: October 04, 2005, 09:59:35 am by iago »
- Newby
http://www.x86labs.org

Quote
[17:32:45] * xar sets mode: -oooooooooo algorithm ban chris cipher newby stdio TehUser tnarongi|away vursed warz
[17:32:54] * xar sets mode: +o newby
[17:32:58] <xar> new rule
[17:33:02] <xar> me and newby rule all

I'd bet that you're currently bloated like a water ballon on a hot summer's day.

That analogy doesn't even make sense.  Why would a water balloon be especially bloated on a hot summer's day? For your sake, I hope there wasn't too much logic testing on your LSAT. 

Offline Quik

  • Webmaster Guy
  • x86
  • Hero Member
  • *****
  • Posts: 3262
  • \x51 \x75 \x69 \x6B \x5B \x78 \x38 \x36 \x5D
    • View Profile
Re: AIM Worm
« Reply #9 on: October 03, 2005, 09:13:18 pm »
A trojan is something with a malicious payload piggybacked on an innocent looking program (kinda like Spyware).


Code: [Select]
<a href="http://www.evilhacker.org/malicious.exe">http://www.goodsite.com/image.jpg</a>
That's usually how it goes, hence my classification as "trojan".

Also, I thought viruses were self-replicating, more oft than worms? I know the definition is getting fuzzy, but there should be some give-aways, shouldn't there?
Quote
[20:21:13] xar: i was just thinking about the time iago came over here and we made this huge bomb and light up the sky for 6 min
[20:21:15] xar: that was funny

Offline Ergot

  • 吴立峰 ^_^ !
  • x86
  • Hero Member
  • *****
  • Posts: 3724
  • I steal bandwidth. p_o
    • View Profile
Re: AIM Worm
« Reply #10 on: October 03, 2005, 09:25:16 pm »
Uhh what does this "malicious program" do ?
Who gives a damn? I fuck sheep all the time.
And yes, male both ends.  There are a couple lesbians that need a two-ended dildo...My router just refuses to wear a strap-on.
(05:55:03) JoE ThE oDD: omfg good job i got a boner thinkin bout them chinese bitches
(17:54:15) Sidoh: I love cosmetology

Offline iago

  • Leader
  • Administrator
  • Hero Member
  • *****
  • Posts: 17914
  • Fnord.
    • View Profile
    • SkullSecurity
Re: AIM Worm
« Reply #11 on: October 03, 2005, 10:22:04 pm »
A trojan is something with a malicious payload piggybacked on an innocent looking program (kinda like Spyware).


Code: [Select]
<a href="http://www.evilhacker.org/malicious.exe">http://www.goodsite.com/image.jpg</a>
That's usually how it goes, hence my classification as "trojan".

Also, I thought viruses were self-replicating, more oft than worms? I know the definition is getting fuzzy, but there should be some give-aways, shouldn't there?

No, that's not a trojan.  A Trojan is an innocent looking program, not link. 

Worms are self-spreading.  Viruses are self-replicating on the current system, and typically infect local files. 

Ergot -- Anything malicious.  Delete files, spread, infect files, log passwords, etc.

Offline Ergot

  • 吴立峰 ^_^ !
  • x86
  • Hero Member
  • *****
  • Posts: 3724
  • I steal bandwidth. p_o
    • View Profile
Re: AIM Worm
« Reply #12 on: October 03, 2005, 10:31:05 pm »
iago - Meaning you don't know yet ^_~
Who gives a damn? I fuck sheep all the time.
And yes, male both ends.  There are a couple lesbians that need a two-ended dildo...My router just refuses to wear a strap-on.
(05:55:03) JoE ThE oDD: omfg good job i got a boner thinkin bout them chinese bitches
(17:54:15) Sidoh: I love cosmetology

Offline Quik

  • Webmaster Guy
  • x86
  • Hero Member
  • *****
  • Posts: 3262
  • \x51 \x75 \x69 \x6B \x5B \x78 \x38 \x36 \x5D
    • View Profile
Re: AIM Worm
« Reply #13 on: October 03, 2005, 10:32:01 pm »
That being the case, this would be more of a virus and not worm. However, some of these malicious AIM-related activities can be more defined as 'trojans'. I'd concider a worm to be something which spreads just by a computer user with a vulnerable version of the program, so that they can get infected without downloading and/or running outside files.
Quote
[20:21:13] xar: i was just thinking about the time iago came over here and we made this huge bomb and light up the sky for 6 min
[20:21:15] xar: that was funny

Offline Armin

  • Honorary Leader
  • x86
  • Hero Member
  • *****
  • Posts: 2480
    • View Profile
Re: AIM Worm
« Reply #14 on: October 03, 2005, 10:32:11 pm »
Usually my entire personal buddy list is infected by some sort of AIM worm, so I scanned a couple of the files with http://www.virustotal.com. They're usually just trojans that spread through AIM by sending messages like the one posted in this topic to everyone on their buddy list. They probably range anywhere from keyloggers, to just giving users full access to the infected computer.

EDIT: I'm slow at posting. :-\
« Last Edit: October 03, 2005, 10:36:30 pm by MetaL MilitiA »
Hitmen: art is gay