"Windows Shares Worm" Found!

At 8:00 AM, Saturday morning, April 1st — this is NOT an April Fools joke — the FBI announced the existence of a self-replicating, i.e. viral worm, that moves from machine to machine across the Internet by exploiting open Windows shares!

Because of the unfortunate timing of this announcement on April 1st, this could be mistaken for an April Fools prank — it is not! Therefore, here is a link to the FBI notice at the National Infrastructure Protection Center (NIPC)

It was bound to happen sooner or later . . . it has happened NOW: Viral code combining a Windows shares scanner with Windows file sharing to locate and copy itself into other Internet-connected Windows machines across the Internet! Because of the vast number of Windows machines with exposed, shared, directories visible to the Internet, this represents a significant new threat.

The SANS Institute has dubbed this the "911" worm because shortly before erasing the user's entire hard drive it uses the system's modem to dial 911, producing a large number of "false positive" emergency calls.

Strictly speaking this is a "worm" more than a "virus" since worms propagate and reproduce themselves without any sort of user involvement or action, whereas a virus requires some inadvertent action on the part of the user. This is the second such worm to have been found "in the wild" and, interestingly, this one knows about and deletes its predecessor when encountered. (A jealous worm?) The worm's payload triggers on the 19th of the month, deleting files from crucial Windows system directories. (You want to be very sure that your system is not infected with it at that time!)

It is not a "high tech" worm, since it was written in the Visual Basic Scripting language. But what's sad — and should be frightening — is that the creation of such a serious and quite damaging Internet threat has become so easy for the "script kiddies."

 Preventing Propagation and Reproduction:

Are your shields up? If you have not done so already, be certain that your own Windows system is not exposing any open directories to the Internet. And then, most importantly, spread the word to any Internet-connected friends, relatives, and associates who might not have already taken these precautions.

As you know, the ShieldsUP! web site is here to help everyone quickly check their systems for known Windows file sharing vulnerabilities. PLEASE encourage everyone to take advantage of this completely free service so that the spread of this frighteningly potent and highly destructive virus can be stopped quickly!

 Detecting the Virus' Presence:

The anti-virus companies have already received virus patterning data from the FBI. Check for updates which recognize the new 911 Virus.

Here's Symantec's page for users of their anti-viral scanner:
   http://www.symantec.com/avcenter/venc/data/bat.chode.worm.html

And here's a link to McAfee / Network Associates page:
   http://vil.mcafee.com/dispVirus.asp?virus_k=98557

And Sophos has two pages describing the two variants they've seen:
   http://www.sophos.com/virusinfo/analyses/911a.html
   http://www.sophos.com/virusinfo/analyses/911b.html

You can scan your system for the following three HIDDEN directories which the 911 virus is known to create: "chode", "foreskin", and "dickhair". <<sigh>> Yes, the author(s) of this virus are apparently not very mature. Classic "script kiddie" nonsense.

IMPORTANT NOTE: Before scanning with the Windows "Find" function, you must be certain that your Windows Explorer is configured to display hidden files and directories: Under the Windows Explorer View/Options menu, select "Show All Files."

I am certain that we have not seen the last of this sort of virus. Please do what you can to educate your friends, relatives, and associates about the dangers of indiscriminate Windows file sharing over the Internet.

They are always welcome to visit the ShieldsUP! web site to test or verify their security and learn more about the risks of careless Internet use.

Thanks for your attention. Spread the word!