Worm-Shiv causes problems with denial of service

By on

A worm that prevents certain applications from working properly has been detected by Webroot.

Andrew Brandt, threat expert at Webroot, described the Worm-Shiv as ‘obnoxious', claiming that ‘there isn't anything especially technically avant-garde or advanced about the worm, nor was it especially difficult to detect or remove. It just exhibits behaviour that, to be blunt, is about as annoying as it possibly can be'.

 

Brandt explained that the infection process starts with a small self-extracting RAR archive executable that when run, drops and executes another .exe file, which in turn drops and executes yet another .exe file.

 

It then puts a copy of a file named wsock32.dll into every single folder on the hard drive and the code is designed to prevent certain applications from working properly.

 

“But even worse, the worm has been engineered to mess with the application window of many anti-virus products, including ours. Not only does the worm make the quarantine button disappear, but then the real shenanigans begin, when you move the mouse pointer anywhere within the program's active window, it immediately snaps the title bar over the mouse pointer, which then sticks to the pointer.

 

“If you move the mouse too quickly when it's “stuck” like that, the mouse pointer just slips off the title bar, leaving the window half off the screen.”


Webroot recommends using a keyboard shortcut for the quarantine feature, where you can just hit the Alt-Q keys instead of trying in vain, over and over, to click the button.

 

Brandt claimed that the creator ‘will think of something even more annoying in the future, but for now, we can all breathe a little easier knowing this Sisyphean nonsense is contained — at least, for the moment.'

See original article on scmagazineuk.com

Copyright © SC Magazine, US edition
Tags:

Most Read Articles

You must be a registered member of iTnews to post a comment.
| Register

Poll

How should the costs of Australia's piracy scheme be split?
Rights holders should foot the whole bill
50/50
ISPs should foot the whole bill
Government should chip in a bit
Other
Flash is heading towards its grave, and that's...
Great! Good riddance
Sad! Flash had some good qualities
Irrelevant. I don't care
What's Flash?
View poll archive

Whitepapers from our sponsors

What will the stadium of the future look like?
What will the stadium of the future look like?
New technology adoption is pushing enterprise networks to breaking point
New technology adoption is pushing enterprise networks to breaking point
Gartner names IBM a 'Leader' for Disaster Recovery as a Service
Gartner names IBM a 'Leader' for Disaster Recovery as a Service
The next era of business continuity: Are you ready for an always-on world?
The next era of business continuity: Are you ready for an always-on world?

Log In

Username:
Password:
|  Forgot your password?