New Skype Worm ANNOYING

[TwinHeadedEagle]

Upload Fixlog here: http://zippyshare.com/

Did ComboFix finished and opened the report?

[rhat0]

Upload Fixlog here: http://zippyshare.com/

Did ComboFix finished and opened the report?

Fixlog: http://www14.zippyshare.com/v/83761389/file.html
ComboFix did finish and it did open the report. It didn't save it anywhere though. When I open up C:\ComboFix it just shows me the "My Computer" menu allowing me to select my drives.

[TwinHeadedEagle]

ComboFix report should be saved in C:\

Try to find it...

[kenny556]

rhat0 is right all you need is someone's skype name and you have their ip address. Anyone can find a free Booter to kick you off for about 30 mins they can also continue the attack if they know your coming back online via skype or a game. Also if they fail to resolve your skype they can just simply send you a tiny url that logs your ip also skype sucks....

[Michael (alan1998)]

Windows 8 is more secure. When XP isn't updated people will focus on that not windows 7 and 8. Considering have of China is currently using XP.

Also, their are other ways of expressing yourself without swearing at those attempting to help you. If the tools fail to run, try them in Safe Mode. I BSoD and my computer is pretty BSoD proof when running GMER.

[rhat0]

Windows 8 is more secure than what? Itself outdated? I sure would hope so. Put Windows up against any other OS and the entire way things are run/setup is a joke. 

I wasn't swearing directly at anyone trying to help me.

[Secondmineboy]

@rhat0: Use Linux if you want to be secure to 95% of malwares, but dont forget Flash and
Java Malware.

There are no real time antiviruses for Linux at the moment.

[rhat0]

No real time Linux protection?
http://www.comodo.com/home/internet-security/antivirus-for-linux.php
http://www.eset.com/us/home/products/nod32-for-linux/
http://support.kaspersky.com/4317

I would most probably get some sort of browser plugin that blocks flash/java unless I trusted the website. Thanks for the tip though. I had already planned switching to Linux, I just haven't been tossing the word around, because a lot of people get offended when you try to tell them that for some miraculous reason Linux has better security than Windows. 

http://www.pcworld.com/article/204423/why_linux_beats_windows_for_servers.html

Anyways, that ComboFix software is a joke. I've run it with Administrator mode and only the first time it ran in a bluish looking command prompt window/terminal. It worked, but never created any type of log file. Now even after uninstalling it... it won't even budge. Nothing is happening, I'm just going to wipe clean and toss a Linux distro on where I will securely store my personal files.

I've also noticed that ComboFix wipes out files without asking.



Oh, you're a leet forum user now too!! Wooop lol.

[Secondmineboy]

Comodo has some real time protection, but mostly for detecting windows Malware so that Linux
is not spreading them.

Which Linux Distribution do you want to use?

[rhat0]

So that Linux isn't spreading it? Windows is the number one spreader in the world. Linux real time protection is mainly just in case and not necessary. The scans are more for in case you use a USB with a Windows device and the USB gets infected. Rarely is it going to be the other way around. After reading your reply twice, I believe you meant to say that Linux real time scanning is mainly to prevent Windows from spreading to Linux via USB or blocking malicious websites?

"In fact, in a hacking competition, Windows and Mac OS X machines were defeated while an Ubuntu machine was still chugging away."

I'll probably go with Fedora and a couple Linux hardening guides. I would setup Windows and attempt hardening it, but that would mean disabling about 90% of the bloated system crap. And hoping that my closed source system isn't setup with a backdoor crawling in code that I cannot see. It is scary to know that your entire system and currently mine is mostly closed source. The code is not visible to our eyes, so we don't know what is really going on in the background. :O

[rhat0]

I decided to resurrect this thread because now I'm not sure if this is even isolated to just Skype. I just powered up my laptop today which has never had issues and the same exact thing is happening to my Google Chrome browser. I launch Chrome and then a chrome.exe runs at 1,500 K usage and idles at about 50 CPU for a while.

Whatever this is I'm pretty pissed off. I've not used a USB device on my laptop in a very long time, so I'm not thinking I've spread it that way. Whatever this is, I'm thinking it has network spreading capabilities and it targets random apps that are most used on the device/system.

I've concluded that I'm formatting every damn device. I'm going to wipe a huge 2 TB external to back up all of my files and to keep this hell torched demon of a worm in the grave, I won't be using the external anywhere except for on my soon-to-be Fedora systems. Screw Windows hard, tempered glass Windows with porcelain... ahahahaaaa. I wonder if anyone will get that? If you have any understanding of physical security, you should. 

I was hoping to be able to get this into the AV database so other people can be protected from this, because this thing is quite nasty from what I'm seeing... but it appears that people just want to do the standard old school annoying tests which include doing a basic scan of services, startup files and such. If someone made it a goal to avoid those scans, what helps then? None of those typical old school scanners that appear ancient and ignore newer types of malicious software that behave much differently and hide themselves in other ways.

What if the infectious software automatically deleted the log files people request here and even more importantly, what if the infectious software disallowed these scanners from running or working properly? I could probably do it without a whole lot of effort. Also, relying on all of these third party softwares to diagnose issues is somewhat laughable as I don't think they're all open source, forgive me if I am wrong. Anyways, thanks all for trying to help out... but Windows just sucks too bad for my interest. I used to be a Windows fanboy, now I'll gladly flush it down the toilet. After all, they have indirectly(accidentally) flushed me and the potential confidentiality, integrity and availability of my system right down the poop shoot. I will enjoy a computer lifestyle without living in fear of being the 80% of computer users that are approximately.

"Windows XP is considerably more prone to malware infection than newer operating systems, Microsoft has said."

Well this is what I say, Windows totally sucks and no matter what special "security" issues they add, they suck and all they do eventually is lock your damn system down to a dog in the cage. They just can't get security right, it is either overkill stupid(still penetrable) or lackluster and vulnerability prone in just about every orifice. My OS will not be a dirty slave... soon. xD

Meanwhile my trustworthy Windows just told me that wiping my 2 TB drive would take 7 minutes, which not many minutes ago it said 7 hours. *shakes head*

While I'm at it, didn't you love those 99% finished downloaded files in dreadful internet explorer. Not to mention Microsoft's own website not working in their latest version of Internet Explorer. And I don't even need to finish off this 4 letter acronym B***. No one likes those ugly blue screens that look freaky. Every time that screen comes up I get some sort of rush wondering if it will be a half hour before I get things started back up or if it will just behave and start back up normally.

How much I will miss Windows: 0%, I will no longer have a toy of an operating system, but a system that works well as a production environment.

Here is an example of how horribly sucky Windows is: Let's say you have a web server up and running with PHP?? If there is any exploit in that and your server allows for connecting to RDP without being prompted for login before seeing the login screen. If you're able to clone cmd.exe to sethc.exe = shift 5 times and now you're into a command prompt window with system level access. What kids created Windows? Seriously...

[Pondus]

Whatever this is I'm pretty pissed off. I've not used a USB device on my laptop in a very long time, so I'm not thinking I've spread it that way. Whatever this is, I'm thinking it has network spreading capabilities and it targets random apps that are most used on the device/system.

MCShield USB protector  http://mcshield.net/    and it is free

[rhat0]

Whatever this is I'm pretty pissed off. I've not used a USB device on my laptop in a very long time, so I'm not thinking I've spread it that way. Whatever this is, I'm thinking it has network spreading capabilities and it targets random apps that are most used on the device/system.

MCShield USB protector  http://mcshield.net/    and it is free

Or for free you could just modify some configurations quickly in Windows to greatly restrict the chance of spreading. Another thing that would greatly suppress USB/removable device spreading is requiring verification/acceptance of accessing or writing to the device by X service or X process except for of course trusted services/processes. Then again, the more that you trust... the more gaping wide open your security policy is. I'd prefer that nothing get on my USB other than what I write to it, only makes sense.

http://support.microsoft.com/kb/967715 <--- Just disable autorun on each Windows system.
http://www.net-security.org/article.php?id=958

Another good idea is to use TrueCrypt, which offers the ability to hide encrypted documents inside of hidden partitions(passworded): http://www.instructables.com/id/How-to-Secure-Your-USB-Drive/

Also, with that software not being open source and me switching to Linux... that software will be of no use to me. Not trying to be mean or anything, but who needs extra software? What people need now days is to understand how they are infected and how to prevent it, not how to lay back in their chairs relaxing while artificial intelligence saves their tails from stupid decisions. Running Windows is a stupid decision. I feel stupid right now for installing it when I got my custom system.

A successful infection is somewhat of a balance between human stupidity and system stupidity. By this I mean that the system lacks basic security principles/abilities and the human makes a wrong choice that leads to their system being compromised. The only thing that an AV does is climb on top of an operating system lacking default system security. This allows for personal users to remain lazy when it comes to security and feel blanketed from attacks, when really they're just protected from already known attacks, not new ones(by the time a new large scale spread exe moves around, plenty of passwords have been stolen not limited to just email accounts, bank account information, credit cards and so on) or even crypted old ones. Things such as EasyPass and other password dictionaries are perfect for attackers too, because what happens when it gets hooked and requested to drain out all credentials? *waves goodbye to all accounts stored*

[Pondus]

MCShield  will clean you usb device if infected, not only stop it from spreading that some other tools do

if you have time and interest you may red this topic (it is 13 pages now) as it explain/answer many questions about MCShield     http://forum.avast.com/index.php?topic=104046.0
specially see the posts from argus / magna86  and dr_bora  the creator of the program


also, exept for the 2 hour update check (default) the program use no resource, i is dormant until a usb device is connected

[rhat0]

MCShield  will clean you usb device if infected, not only stop it from spreading that some other tools do

if you have time and interest you may red this topic (it is 13 pages now) as it explain/answer many questions about MCShield     http://forum.avast.com/index.php?topic=104046.0
specially see the posts from argus / magna86  and dr_bora  the creator of the program


also, exept for the 2 hour update check (default) the program use no resource, i is dormant until a usb device is connected

I have Outpost removable media protection set to block autorun.inf and block any application from launching that does not have a digital signature. Plus I use a usb immunizer from a different source since avast doesn't provide this.

Avast should release their own usb immunizer so users do not need to go to other sources. This would help to protect any computer that you plug a usb into from autorun based malware.

Commonly exploited:

* autorun.inf
* Desktop.ini/comment.htt/ActiveX
* user
* Windows Shell-LNK exploit (newest method)

Good thing I won't be running Windows soon, lol.

This may be helpful for other individuals that may continue to use Windblows:
"disable script for all drives except file system drive,make new software restriction policy dude!!"
And: http://labs.bitdefender.com/projects/usb-immunizer/overview/

I've looked around and see a lot of self promotion of MC Shield. I'm not saying MC Shield is bad, but why not just implement the core functionality/features right into Avast if it works so well?? =//