LOOKS LIKE COMPUTER ASSOCIATES ANTI-VIRUS GOT WHACKED TODAY

[Rusty Nale]

Based on the reports I am seeing around the Internet, it looks like Computer
Associates and their E-Trust anti-virus download sites got either hit or
infected this morning (Kama-Sutra???) as many folks are complaining that
they cannot update AND the updating services turning their real-time
scanning engines off, etc, etc, etc. Their website (which is always a
hodge-podge mess to begin with) and help sites were running very slow when
they were running at all and a friend tells me he was unable to get through
on real-time chat with them after his java window reported there were 257
people waiting ahead of him for a rep to come online!!! After waiting four
hours, he gave up. Their phone lines were also busy or unreachable during
the daytime. What a mess.

 

[Galen]

In Rusty Nale had this to say:

My reply is at the bottom of your sent message:

Based on the reports I am seeing around the Internet, it looks like
Computer Associates and their E-Trust anti-virus download sites got
either hit or infected this morning (Kama-Sutra???) as many folks are
complaining that they cannot update AND the updating services turning
their real-time scanning engines off, etc, etc, etc. Their website
(which is always a hodge-podge mess to begin with) and help sites
were running very slow when they were running at all and a friend
tells me he was unable to get through on real-time chat with them
after his java window reported there were 257 people waiting ahead of
him for a rep to come online!!! After waiting four hours, he gave
up. Their phone lines were also busy or unreachable during the
daytime. What a mess.

I can only confirm that my webslave (webmaster but he's not that good yet
<g>) has been suffering an inability to connect for quite some time. My
recommendation to him, with the influx of the latest worm being due, was to
take a night off, drink beer, sleep, and ignore the PC until tomorrow as
he's likely clean anyhow and he's checked with another AV application that's
at least as capable as CA's stuff. (It took a bit to ween him from Norton so
I'm happy that it's getting further.)

Galen
--

 

[Gabriele Neukam]

On that special day, Rusty Nale, ([email protected]) said...

Based on the reports I am seeing around the Internet, it looks like Computer
Associates and their E-Trust anti-virus download sites got either hit or
infected this morning (Kama-Sutra???) as many folks are complaining that
they cannot update AND the updating services turning their real-time
scanning engines off, etc, etc, etc.

Maybe the reason is another one. CA products can be stalled by
malformed packets. If they are using them on their own servers, they
have probably been the target of an "experiment".

See

http://www.derkeiler.com/Mailing-Lists/securityfocus/bugtraq/2006-02/msg00031.html

Gabriele Neukam

(e-mail address removed)

 

[Nexus7]

Then again, Nyxem has no destructive payload that would cause server
instability -- it deletes nonexecutable data types, and it can't even
spread over network shares. I wouldn't be surprised if it was someone
being a pain with malformed packets / DDOS / someone hitting the wrong
switch in the server room, but it's definitely not "Kama Sutra" worm
related.

 

[gobels]

I read one interesting article on Kamasutra virus.

http://jayantpotdar.blogspot.com/2006/02/kama-sutra-tale-of-love-or-virus.html