View Single Post
  #52   Report Post  
Old 13-09-2003, 08:42 PM
al
 
Posts: n/a
Default sequel to blaster worm

"Jaques d'Altrades" wrote in message
Send me a virus, worm or trojan, and I'd know. With my mail/news reader
I can open any item without running the attachment, and if there is one,
it's signalled. Then I'd have to decode it and go to the directory into
which it has been placed, and run it.

How would I contract it? Certainly not through mail or news, and I
rarely bother with the www. If and when I do I'll think about AV and
firewall.

Well to take a recent example - the Blaster worm. That would have infected
you as soon as you connected to the internet if you weren't blocking NetBIOS
(or you're lucky enough to have it blocked by your ISP). Nothing to do with
email, news, etc. or any kind of user interaction.

Seven years without trouble speaks for itself. And yes, I know what a
trojan looks like, having examined one in a text editor.

Seven years is just pure luck - assuming of course you'd actually know you'd
been compromised (you run a netstat recently to see what open ports you
have?) Again what you're talking about points to virii, not worms. Sure,
someone can send you a trojan and if you're silly enough to open it (which
it sounds like you're not) then you're "infected". However how would you
know if someone put one there by exploiting a remote vulnerability? You
wouldn't.

As for opening a trojan in a text editor ... !?!? What are you saying, you
decompiled one? Smart trojans add code to existing binaries to hide
themselves. Others load themselves as executables that sound like official
processes. Not aware of too many ASCII based script trojans ....



a