Valhalla Legends Archive

General => General Discussion => Topic started by: Grok on July 19, 2004, 04:27 PM

Title: New Worm
Post by: Grok on July 19, 2004, 04:27 PM
WORM_WUKILL.E (http://www.trendmicro.com/vinfo/virusencyclo/default5.asp?VName=WORM_WUKILL.E&VSect=T)

It hit us within 5 hours of release.  Written in VB6.  heh.
Title: Re:New Worm
Post by: Newby on July 19, 2004, 04:39 PM
"RUN-TIME ERROR" :p
Title: Re:New Worm
Post by: Zorm on July 19, 2004, 05:19 PM
Why are these things called worms? Whatever happened to just a plain virus?! To me a plain virus is one that is harmless until the person in the chair does something and a worm would be something like blaster/sql slammer/ect that doesn't require the user opening a file or such to cause infection.
Title: Re:New Worm
Post by: Adron on July 19, 2004, 05:29 PM
Quote from: Zorm on July 19, 2004, 05:19 PM
Why are these things called worms? Whatever happened to just a plain virus?! To me a plain virus is one that is harmless until the person in the chair does something and a worm would be something like blaster/sql slammer/ect that doesn't require the user opening a file or such to cause infection.

I think it's because it distributes itself from one computer to the next as opposed to just infecting ("trojaning") local files and expecting the user to move an infected file to another computer.
Title: Re:New Worm
Post by: quasi-modo on July 19, 2004, 06:38 PM
Its kind of amazing how trend micro can research and come up with fixes for new viruses so fast, because this virus does not look to be spreading too fast (from the link in the first post).
Title: Re:New Worm
Post by: iago on July 19, 2004, 08:29 PM
Quote from: peofeoknight on July 19, 2004, 06:38 PM
Its kind of amazing how trend micro can research and come up with fixes for new viruses so fast, because this virus does not look to be spreading too fast (from the link in the first post).

I was reading somewhere about the number of "buckets" on the internet used for tracking worms, and there are _a lot_ of them.  

One thing I don't understand:
QuoteDiscovered: 18 hours, 26 minutes ago
(Jul. 19, 2004 12:00:00 AM GMT -0800)   
Detection available: 18 hours, 26 minutes ago
(Jul. 19, 2004 12:00:00 AM GMT -0800)
They instantly had detection: :-/
Title: Re:New Worm
Post by: MyndFyre on July 19, 2004, 08:44 PM
Quote from: iago on July 19, 2004, 08:29 PM
Quote from: peofeoknight on July 19, 2004, 06:38 PM
Its kind of amazing how trend micro can research and come up with fixes for new viruses so fast, because this virus does not look to be spreading too fast (from the link in the first post).

I was reading somewhere about the number of "buckets" on the internet used for tracking worms, and there are _a lot_ of them.  

One thing I don't understand:
QuoteDiscovered: 18 hours, 26 minutes ago
(Jul. 19, 2004 12:00:00 AM GMT -0800)   
Detection available: 18 hours, 26 minutes ago
(Jul. 19, 2004 12:00:00 AM GMT -0800)
They instantly had detection: :-/

Heh.  I noticed a new worm came out because my virus scanner didn't pick up the dog.scr attachment -- of all things, Outlook 2003 did.  ;)
Title: Re:New Worm
Post by: iago on July 19, 2004, 11:20 PM
Quote from: Zorm on July 19, 2004, 05:19 PM
Why are these things called worms? Whatever happened to just a plain virus?! To me a plain virus is one that is harmless until the person in the chair does something and a worm would be something like blaster/sql slammer/ect that doesn't require the user opening a file or such to cause infection.

I was wondering about that myself, actually.  Generally worms are things that could happen when nobody is even touching the computer, and that spread through exploits.  But *shrug* MassMailers are normally called Worms, so who knows?
Title: Re:New Worm
Post by: quasi-modo on July 20, 2004, 01:51 AM
Well netsky is a worm, it has its own built in smtp type of deal going on. Now there is something called html netsky, it is an html email but encorperates an ie exploit to run the attachments from the html, pretty slick.
Title: Re:New Worm
Post by: muert0 on July 20, 2004, 02:09 PM
A mass-mailer is a worm because it self replicates.
http://www.webopedia.com/TERM/w/worm.html
Title: Re:New Worm
Post by: iago on July 20, 2004, 07:47 PM
Hmm, it seems that you're right :)

Quote<networking, security> (From "Tapeworm" in John Brunner's
novel "The Shockwave Rider", via XEROX PARC) A program that
propagates itself over a network, reproducing itself as it
goes. Compare virus. Nowadays the term has negative
connotations, as it is assumed that only crackers write
worms.

Perhaps the best-known example was the Great Worm.

Compare Trojan horse.

From The Free Online Dictionary of Computing (http://foldoc.doc.ic.ac.uk/foldoc/Dictionary.gz)
Title: Re:New Worm
Post by: muert0 on July 20, 2004, 08:35 PM
Definitions seem about the same to me. And a mass-mailer propogates over a network through email, right? But I guess they don't move by thereselves because there's that one step that requires a retard to just open any random attachments. And they think I have a/v so I'm protected.
Title: Re:New Worm
Post by: quasi-modo on July 20, 2004, 10:31 PM
Quote from: muert0 on July 20, 2004, 08:35 PM
Definitions seem about the same to me. And a mass-mailer propogates over a network through email, right? But I guess they don't move by thereselves because there's that one step that requires a retard to just open any random attachments. And they think I have a/v so I'm protected.
well thats the neat thing about html netsky, it realies on ie's crappyness to automatically run the attachments.
Title: Re:New Worm
Post by: muert0 on July 20, 2004, 10:37 PM
I block out any email with attachments.
Title: Re:New Worm
Post by: quasi-modo on July 20, 2004, 10:38 PM
I should... but every so often friends send me stuff with attachments. unfortunatly they are the types of people that download coolsong.mp3               .exe on kazaa.
Title: Re:New Worm
Post by: iago on July 20, 2004, 11:18 PM
At work I needed a Javascript file for a project I was working on, and Outlook absolutely forbade me from opening it.  It was pretty annoying, there should be a way for users to override it :(

I replied and got him to rename it from .js to .outlooksucks, and it worked.  This was one Linux guy to another, though.
Title: Re:New Worm
Post by: Stealth on July 21, 2004, 12:24 AM
Quote from: iago on July 20, 2004, 11:18 PM
At work I needed a Javascript file for a project I was working on, and Outlook absolutely forbade me from opening it.  It was pretty annoying, there should be a way for users to override it :(

I replied and got him to rename it from .js to .outlooksucks, and it worked.  This was one Linux guy to another, though.

This is the same way we circumvented our school's .EXE and .ZIP download blocking setup to install JCreator 2.5 Free on all the lab computers. (We had been using CodeWarrior, but our school's license expired.)
Title: Re:New Worm
Post by: quasi-modo on July 21, 2004, 12:34 AM
Quote from: Stealth on July 21, 2004, 12:24 AM
Quote from: iago on July 20, 2004, 11:18 PM
At work I needed a Javascript file for a project I was working on, and Outlook absolutely forbade me from opening it.  It was pretty annoying, there should be a way for users to override it :(

I replied and got him to rename it from .js to .outlooksucks, and it worked.  This was one Linux guy to another, though.

This is the same way we circumvented our school's .EXE and .ZIP download blocking setup to install JCreator 2.5 Free on all the lab computers. (We had been using CodeWarrior, but our school's license expired.)
eh jcreator... used that in ap comp sci. Hey anyone else take that? What did you get on the ap? I just got my score mailed, got a 3.
Title: Re:New Worm
Post by: Banana fanna fo fanna on July 21, 2004, 09:31 AM
ew, you're a smart guy; how'd you pull that off?
Title: Re:New Worm
Post by: quasi-modo on July 21, 2004, 09:52 AM
Its hard to tell if you are being serious or sarcastic on this forum lol.
Title: Re:New Worm
Post by: iago on July 21, 2004, 10:45 AM
JCreator sucks. :)
Title: Re:New Worm
Post by: Banana fanna fo fanna on July 21, 2004, 11:18 AM
Quote from: peofeoknight on July 21, 2004, 09:52 AM
Its hard to tell if you are being serious or sarcastic on this forum lol.

Was serious about the smart guy part.
Title: Re:New Worm
Post by: quasi-modo on July 21, 2004, 04:30 PM
Well, I don't know java, I know how to print out useless pyramids of 1s through 3 or 4 recursive statments. My teacher tought me AP style java, how to do it without brackets and how to do things I could easily do with a loop through the use of several recursive statements (like java does not lag enough). So I can't do a single practical thing in java, but I passed the ap. We did not even learn applets or gui  :'(. I am not motivated enough to pick up a book and learn that on my own though.
Title: Re:New Worm
Post by: Stealth on July 21, 2004, 07:20 PM
Quote from: iago on July 21, 2004, 10:45 AM
JCreator sucks. :)

We had all kinds of problems. I guess the word I'd use to describe it would be "moody" -- some of the computers ran it better than others, and inexplicably the same pieces of code would fail with strange compiler errors on some machines but not others.

I also got a 3 on the AP Comp Sci exam, peofeoknight.
Title: Re:New Worm
Post by: quasi-modo on July 21, 2004, 08:14 PM
Did your teacher teach you how to print out
               1
             1 1
           1 1 1
         1 1 1 1
       1 1 1 1 1
etc with recursive statements :P
edit: AGH... I cant shape a triangle of the number 1 with this!

APCS code is not real world...
Title: Re:New Worm
Post by: Tuberload on July 21, 2004, 10:04 PM
public class Pyramid
{    
   public void pyramid (int start, int width)
   {
       if (start%2 == 0)   // prevent even numbers
           --start;
       
       int space;

       if (start < width)
           space = (width-start)/2+1;
       else
           space = 0;
       
       for (int j = 0; j < space; j++)
           System.out.print (" ");
       for (int i = 0; i < start; i++)
           System.out.print ("*");
       System.out.println();
       
       if (start < width)
           pyramid (start+2, width);
   }
}
Title: Re:New Worm
Post by: iago on July 22, 2004, 12:26 AM
Quote from: Tuberload on July 21, 2004, 10:04 PM
       if (start%2 == 0)   // prevent even numbers
           --start;
}


I would have done:

(start & 1) && --start;

Much more cryptic that way :D

(ps: I'm not sure if Java lets you do that, but eh?)

<edit> aww, you don't.  You need to ust C to do cryptic code like that *sniff*
Title: Re:New Worm
Post by: quasi-modo on July 22, 2004, 12:27 AM
Quote from: peofeoknight on July 21, 2004, 08:14 PM
etc with recursive statements :P
with recursive statements, not loops. Try it with 3 recursive statements. Its a HUGE pain in the butt. You can do it, its just annoying as heck. And on the ap they ask you what code does, and they give you all this recursive bs, and you have to make a lil drawing with boxes and arrows and numbers so you can get to the answer because values are flowing everywhere. The ap is an example of stuff should not be done, I mean this code would give you a bad stack and make the application just bog the heck down if real programmers did this.
Title: Re:New Worm
Post by: Tuberload on July 22, 2004, 12:39 AM
I used a recursive statement to print out each line.
pyramid (start+2, width);

I don't quite know how to print each individual character recursively. I'll see what I can come up with.

Edit:I think I just figured out a way to do it so I will post my results tomorrow.  :) This is the first recursive method I have ever written.
Title: Re:New Worm
Post by: quasi-modo on July 22, 2004, 01:12 AM
Ok I just saw the loops, I did not look in the last loop. But see how useless and unrealistic this bs is?
Title: Re:New Worm
Post by: Tuberload on July 22, 2004, 01:13 AM
Quote from: peofeoknight on July 22, 2004, 01:12 AM
Ok I just saw the loops, I did not look at the last loop.

Is it supposed to recursively print out each character?
Title: Re:New Worm
Post by: quasi-modo on July 22, 2004, 01:37 AM
yes lol... lame huh.
Title: Re:New Worm
Post by: Tuberload on July 22, 2004, 02:47 AM
Quote from: peofeoknight on July 22, 2004, 01:37 AM
yes lol... lame huh.

Yes it seems pointless, but something to do nonetheless. I will see what I can come up with.