Mydoom Virus (Reward)

30 Jan 2004

I have just heard on Radio 4 that Bill Gates the head of Microsoft worship

is offering a $ reward to anyone who identifies the hacker responsible for creating the Mydoom virus. 8) If any Swinging Heaven member is able to detect who this hacker is and thus wins this reward, could I suggest he hosts the biggest Swinging Heaven party ever. lol

Harry0

30 Jan 2004

I wish some body would find out who did it!
I'm checking email online still and have been sent it 9 times so far this morning mad

:x :x :x
Dawn :silly:

30 Jan 2004

Bill Gates obviously wants to offer him a job to de-bug the development version of the new windows o/s as they can't do it properly themselves

:rotflmao: :rotflmao: :rotflmao:

30 Jan 2004

Quote by Mark
You'd think people would have better things to do... but I suppose it does make them feel big and important for a while, who knows

The most depressing thought of it all Mark, is that these :censored: :censored: :censored: :censored: :censored: eventually get offered a job by top software houses as security consultants earning serious money mad

30 Jan 2004

Quote by brumlad
The most depressing thought of it all Mark, is that these :censored: :censored: :censored: :censored: :censored: eventually get offered a job by top software houses as security consultants earning serious money

Never in my experience Brumlad - though I do know some organisations that ask less questions than others........... rolleyes

But I have to agree with you Mark they will always find ways to justify what they do - i.e. I wrote the virus to expose a vulnerability in Microsoft xxxxxxxxxx. How about just telling them like the rest of the IT security world? confused

:? :?
The only pleasure I get is that knowing how much damage some of their little toys cause they cannot open their gobs and crow about it to anyone for fear of the consequences - I'll bet that just makes them seethe! rotflmao

30 Jan 2004

If Harry0 is about would be interested in your views.
I followed the links listed on a thread here to get a MyDoom virus removal tool, so d/l it and ran it.
Then got a txt file with following in it:
-------------------------------------------------------------------------------
Norman MydoomFix (C) 2004 Norman ASA
Norman engine version:
Checking processes.
Scanning files on disk. This may take some time.
Scanning drive: c:
Scanning drive: d:
Scanning drive: e:
Cleaning the registry
Setting reg key: HKCRCLSID{E6FB5E20-DE35-11CF-9C87-00AA005127ED}InprocServer32 to
Deleted registry key: HKLMSOFTWAREMicrosoftWindowsCurrentVersionRunDisc Detector
Deleted registry key: HKLMSOFTWAREMicrosoftWindowsCurrentVersionRunCTStartup
Deleted registry key: HKLMSOFTWAREMicrosoftWindowsCurrentVersionRunJet Detection
Deleted registry key: HKLMSOFTWAREMicrosoftWindowsCurrentVersionRunATIPTA
Deleted registry key: HKLMSOFTWAREMicrosoftWindowsCurrentVersionRunShare-to-Web Namespace Daemon
Infected processes killed: 0
Files scanned: 45737
Infected files: 0 deleted, 0 repaired
Done!
---------------------------------------------------------------------------------
My question is why would it delete those registery keys?
Oh by the way, just as two wrongs don't make a right .... just because I understand the word 'registry' and the word 'key' it don't mean understand 'registry key' lol!
One of your usual 'cut throght' posts would be appreciated lol

30 Jan 2004

Hi Griffin,
Re. our chat in the SH Chatroom I would advise you get the full AVG anti virus programme its well worth it.
Harry0

31 Jan 2004

Feenix
Changing The Class Identifier is a protection measure against backdoor processes that can be running in a stealth mode and the default should be
Removing run registry keys are because code inside them was suspect because the keys had been changed at some point. There will be less things running on your taskbar in the background now but to me that is not a bad thing! The share to web one is a dangerous one to leave running at the best of times. I think you have cd writing software installed which has a disc detector process running. This has been stopped along with several other processes like a graphics card one and print services one. If everything is running as before then you have no problems.
The good news is - you were not infected!
Fred

31 Jan 2004

Many thanks Fred for the update
LOL it actually makes sense!
I'm in that dangerous state of knowing a little bit about this stuff and therefore likely to meddle

31 Jan 2004

At least you recognise it feenix - most people stumble around suffering "False Authority Syndrome" and spouting to all within range once they have worked out how to run a piece of software to clean out a single virus or stumble across a good website! Anyone in IT security doesn't mind, they pick up the pieces and the extra work when it all goes wrong! lol

:lol:
Hang in there and always ask questions - no such thing as a stupid question in my book!
Fred