Windows Updates infected with rootkit! (sigh)

[Lain (is Bams)]

http://news.cnet.com/8301-27080_3-10456162-245.html?part=rss&tag=feed&subj=InSecurityComplex



Windows systems that crashed during the latest Microsoft security update last week did so because they were infected with a rootkit program that made changes to the operating system kernel, Microsoft said late on Wednesday.

"The restarts are the result of modifications the Alureon rootkit makes to Windows Kernel binaries, which places these systems in an unstable state," Mike Reavey, director of the Microsoft Security Response Center, wrote in a blog post. "In every investigated incident, we have not found quality issues with security update MS10-015."

The patch addresses a vulnerability in the 32-bit Windows kernel that could allow elevation of privilege that was disclosed last month.

The Win32/Alureon family of malware can modify DNS settings, hijack searches, and fraudulently click on ads, Microsoft said in a post on its Malware Protection Center Blog. Last year, versions appeared that infect the miniport driver associated with the hard disk of the operating system, the post says.

Microsoft will not offer the patch through Automatic Update for 32-bit Windows systems until a solution is available, but 64-bit versions will be offered.

Anyone believed to have been affected by the Alureon rootkit can visit https://consumersecuritysupport.microsoft.com. Those in the United States can contact Customer Service and Support at no charge using the PC Safety hotline at 1-866-727-2338 (PCSAFETY). Those outside the United States can find local contact numbers at http://support.microsoft.com/international.

Customers who choose not to install the update can implement the workaround or install the update manually as outlined in the MS10-015 bulletin.

"A malware compromise of this type is serious, and if customers cannot confirm removal of the Alureon rootkit using their chosen anti-virus/anti-malware software, the most secure recommendation is for the owner of the system to back up important files and completely restore the system from a cleanly formatted disk," Microsoft said.

For instructions on how to back up your files in Windows, visit this page. For instructions on how to reinstall Windows, visit this page.


Anyone who uses Windows should be watching the wire for stuff like this. Make sure you're not infected. I mean, it's not like the viruses are coming from Microsoft or anything right? Wait... FUCK!

[Lain (is Bams)]

http://www.microsoft.com/security/portal/Threat/Encyclopedia/Entry.aspx?Name=Win32%2fAlureon

More Info

ETA:

REMOVAL?!? Good luck trying to decode this crap. Following the MS KB article trails can make you queezy sometimes.

Recovery
The Win32/Alureon trojan may enable an attacker to transmit malicious data to the infected computer. Recovering from this situation may require measures beyond removing the trojan itself from the computer. Use Microsoft Windows Defender, Microsoft Security Essentials, the Windows Live safety scanner, or another up-to-date scanning and removal tool to detect and remove this threat and other unwanted software from your computer. For more information on Microsoft security products, see http://www.microsoft.com/protect/products/computer/default.mspx.

The Domain Name System (DNS) is used (among other things) to map domain names to IP addresses - that is, to map human-readable domain names to machine-readable IP addresses. When a user attempts to visit a particular URL, a browser will use DNS servers to find the correct IP address of the requested domain. When a user is directed to a malicious server that is not part of the authoritative Domain Name System, an attacker can provide incorrect IP addresses at their choice to map to particular domain names, thus directing the user to possibly bogus or malicious sites without the affected user's knowledge.

Win32/Alureon may modify DNS settings on the host computer, thus the following steps may be required after the Win32/Alureon removal is complete:

*
If the computer has a network interface that does not receive a configuration using DHCP, reset the DNS configuration if necessary. For information on configuring TCP/IP to use DNS in Windows XP, see http://support.microsoft.com/kb/305553

*
If a dial-up connection is sometimes used from the computer, reconfigure the dial-up settings in the rasphone.pbk file as necessary, as Win32/Alureon may set the fields "IpDnsAddress" and "IpDns2Address" in the rasphone.pbk file to the attacker's address. The Microsoft scanner code that automatically removes Win32/Alureon backs up the infected dial-up configuration file to:
%allusersprofile%\Application Data\Microsoft\Network\Connections\Pbk\rasphone.pb k.bak

[Fmeh]

This is awful news. I imagine I'll be getting a lot of calls this week about problems people are having with their computers.....

I get updates manually, always have, and I only get critical updates when I do. People have called me paranoid, people have even called me stupid for not wanting all the updates, but I always knew something like this was possible, and quite frankly, some of Microsoft's updates slow down people's computers and most of the updates are related to holes in Internet Explorer, which I don't use. It's why any program that has an auto-update manager that's hard to disable is a program I do not wish to use (cough cough Google products cough cough).

[Lain (is Bams)]

Get the latest computer updates
Updates help protect your computer from viruses, worms, and other threats as they are discovered. It is important to install updates for all the software that is installed in your computer. These are usually available from vendor Web sites.

You can use the Automatic Updates feature in Windows to automatically download future Microsoft security updates while your computer is on and connected to the Internet.

:lol: Fucking classic.

[Briana Dawson]

I really don't understand what this means or how i would know if this happened to my computer.

[Lain (is Bams)]

I really don't understand what this means or how i would know if this happened to my computer.

In the simplest terms, Microsoft made available too, and pushed out an update to Windows users last week that was infected with a piece of malware commonly referred to as a rootkit. A rootkit is a piece of code that subverts your systems security by compromising it at the kernel level (the lowest possible point in the OS chain) and exploiting your system for whatever nefarious purposes he/she may have.

Usually we get this sort of badness from assholes who write viruses and kids who think it's clever to infect pdf files and email them to old ladies. That's how botnet's are formed.

So in this case, Microsoft itself was the source of the malware, and the irony of it is that in their fix they tell you to update your fucking Windows OS, which caused the malware in the first place.

You can boot your machine in Safe Mode and scan it with any up to date virus scanner and it should let you know if your infected. If you are infected, it's going to be a real pain in the ass to purge it and put your setup back to normal, as it makes some pretty depe modifications to your DNS subsystems, and lots of other fun stuff like that (DNS is the part of your system that turns names into numbers i.e. google.com = IP address).

:dancingbanana3:

[Questor Sinclair]

in Bams' second post, they say Windows Defender will find and remove the trojan if it's there, so I'll run that just in case. Defender should be on all modern systems, though it can be downloaded as freeware if not.

[Lucifer Baphomet]

Checked update history....

I don't have that update

Whew

[Kokoro Fasching]

http://news.cnet.com/8301-27080_3-10456162-245.html?part=rss&tag=feed&subj=InSecurityComplex



Anyone who uses Windows should be watching the wire for stuff like this. Make sure you're not infected. I mean, it's not like the viruses are coming from Microsoft or anything right? Wait... FUCK!

Actually, the update wasn't infected. The machine was already infected, which made the machine unstable. When the update tried to complete at the reboot stage, the already existing malware caused the bluescreen.

[Lain (is Bams)]

Actually, the update wasn't infected. The machine was already infected, which made the machine unstable. When the update tried to complete at the reboot stage, the already existing malware caused the bluescreen.

Ahh I misread the post. Too much pot I guess. Bunnie and I have been torched up for a few days cause she's feeling better and we got a new bed (translates to less sleep :fangirl:). Well fuck MS anyhow.

Here's a fun follow-up.

Hacker's update their rootkit to stop BSODs (http://news.idg.no/cw/art.cfm?id=D8BDF324-1A64-67EA-E48BA4500399EF81)

[Beezle Warburton]

http://www.symantec.com/connect/blogs/tidserv-and-ms10-015

[Beezle Warburton]

Checked update history....

I don't have that update

Whew

The problem IS NOT the update itself.

The problem only happens if your machine is already infected.

[Beezle Warburton]

I really don't understand what this means or how i would know if this happened to my computer.

If you run Windows update and your machine BSOD's, then you have this problem.

All of my computers have been running windows update just fine, but they're (A) behind a router and (B) I run Kaspersky AV.

[Kokoro Fasching]

Ahh I misread the post. Too much pot I guess. Bunnie and I have been torched up for a few days cause she's feeling better and we got a new bed (translates to less sleep :fangirl:). Well fuck MS anyhow.

Here's a fun follow-up.

Hacker's update their rootkit to stop BSODs (http://news.idg.no/cw/art.cfm?id=D8BDF324-1A64-67EA-E48BA4500399EF81)

Damn.. be sharing the smoke! *smokes y'alls hair to get a good contact buzz*

[Kristian]

n/m my bad

[Forest]

Ahh I misread the post. Too much pot I guess. Bunnie and I have been torched up for a few days cause she's feeling better and we got a new bed (translates to less sleep :fangirl:). Well fuck MS anyhow.

Here's a fun follow-up.

Hacker's update their rootkit to stop BSODs (http://news.idg.no/cw/art.cfm?id=D8BDF324-1A64-67EA-E48BA4500399EF81)

YouTube- The Toyes - Smoke Two Joints

[Lain (is Bams)]

YouTube- The Toyes - Smoke Two Joints (http://www.youtube.com/watch?v=mv1yQ-UuNpA)

Bunnie and I love that song. My brother gave us some of their CDs. He knows them from when he lived down in Corvallis. :)

[Forest]

Bunnie and I love that song. My brother gave us some of their CDs. He knows them from when he lived down in Corvallis. :)

KFOG here in the bay area plays that song every Friday at 5pm and has for all 12 years or so I've lives out here and I know it was a long tradition before that. :p

[Dale Innis]

KFOG here in the bay area plays that song every Friday at 5pm and has for all 12 years or so I've lives out here and I know it was a long tradition before that. :p

Not at 4:20?????