news said:
Whoever wrote w32.spybot.worm NEEDS some time in jail.
Perhaps, but the odds are in their favor that nothing will be done.
I get the infection every 1-2 wks and then remove it. It then comes
back.
[snip]
How do I stop further files being installed?
Is a router the answer?
30 seconds to do a search with Google for W32.Spybot.Worm came up with the
following info from Symantec:
-------------------------------------
W32.Spybot.Worm is a detection for a family of worms that spreads using
the Kazaa file-sharing network and mIRC. This worm can also spread to
computers that are compromised by common back door Trojan horses and on
network shares protected by weak passwords.
Newer variants may also spread by exploiting the following
vulnerabilities:
* The DCOM RPC Vulnerability (described in Microsoft Security Bulletin
MS03-026) using TCP port 135.
* The Microsoft Windows Local Security Authority Service Remote Buffer
Overflow (described in Microsoft Security Bulletin MS04-011).
* The vulnerabilities in the Microsoft SQL Server 2000 or MSDE 2000
audit (described in Microsoft Security Bulletin MS02-061) using UDP port
1434.
* The WebDav Vulnerability (described in Microsoft Security Bulletin
MS03-007) using TCP port 80.
* The UPnP NOTIFY Buffer Overflow Vulnerability (described in Microsoft
Security Bulletin MS01-059).
* The Workstation Service Buffer Overrun Vulnerability (described in
Microsoft Security Bulletin MS03-049) using TCP port 445. Windows XP users
are protected against this vulnerability if the patch in Microsoft Security
Bulletin MS03-043 has been applied. Windows 2000 users must apply the patch
in Microsoft Security Bulletin MS03-049.
* The Microsoft Windows SSL Library Denial of Service Vulnerability
(described in Microsoft Security Bulletin MS04-011).
* The VERITAS Backup Exec Agent Browser Remote Buffer Overflow
Vulnerability (as described here).
* The Microsoft Windows Plug and Play Buffer Overflow Vulnerability
(described in Microsoft Security Bulletin MS05-039).
-------------------------------------
I would suggest you install a firewall (or at the very least a router),
make sure your systems are all up to date with security related patches,
uninstall Kazaa and stop using mIRC. If that doesn't take care of the
problem, then I suggest you get someone who knows what they are doing to
come in and help you secure your network. You obviously don't know how to
do so. That's not meant as an insult, just an observation.
Meanwhile can the Federal Bureau Investigation PLEASE arrest some
people who wrote the spybot pgm?
Which wouldn't resolve your problem at all. In most cases, arresting the
original author(s) doesn't help much once the exploit code is out on the
net and making the rounds. There are usually plenty of others who then take
it and spread it further.
