Warning! nasty one

[pcbutts1]

I've seen this thing change group policy, expire passwords and modify the
boot.ini. Warning Newbie's don't go here or you will be asking for help to
get rid of it. 64_201_199_24 it arrives in email claiming to be a youtube
video. Dustin you like shit like this have fun.


--

Newsgroup Trolls. Read about mine here http://www.pcbutts1.com/downloads
The list grows. Leythos the stalker http://www.leythosthestalker.com, David
H. Lipman, Max M Wachtell III aka What's in a Name?, Fitz,
Rhonda Lea Kirk, Meat Plow, F Kwatu F, George Orwell

 

[jen]

I've seen this thing change group policy, expire passwords and modify
the boot.ini. Warning Newbie's don't go here or you will be asking for
help to get rid of it. 64_201_199_24 it arrives in email claiming to
be a youtube video. Dustin you like shit like this have fun.

Storm of the Day, Now with YouTube:
http://isc.sans.org/diary.html?storyid=3321

-jen

 

[pcbutts1]

Yep, that be it.

--

Newsgroup Trolls. Read about mine here http://www.pcbutts1.com/downloads
The list grows. Leythos the stalker http://www.leythosthestalker.com, David
H. Lipman, Max M Wachtell III aka What's in a Name?, Fitz,
Rhonda Lea Kirk, Meat Plow, F Kwatu F, George Orwell

 

[Bart Bailey]

I've seen this thing change group policy, expire passwords and modify the
boot.ini. Warning Newbie's don't go here or you will be asking for help to
get rid of it. 64_201_199_24 it arrives in email claiming to be a youtube
video. Dustin you like shit like this have fun.

F-Prot sez:
VIDEO.EXE Infection: Possibly a new variant of
W32/Fathom.3-based!Maximus

 

[Andy Walker]

Storm of the Day, Now with YouTube:
http://isc.sans.org/diary.html?storyid=3321

-jen

The article doesn't mention it but the IP addresses in the malicious
links are infected zombie computers located all over the world. I
haven't yet seen two the same in all the samples I've collected,
although it is clear that infected computers can send out numerous
emails.

The F-Secure weblog has been pretty good at keeping up on the new
variants http://www.f-secure.com/weblog/

 

[Clark]

I've seen this thing change group policy, expire passwords and modify
the boot.ini. Warning Newbie's don't go here or you will be asking
for help to get rid of it. 64_201_199_24 it arrives in email claiming
to be a youtube video. Dustin you like shit like this have fun.

I can't wait for my customers to Click it !!!

Cha Ching!!!


Clark

 

[/Tx2]

On Mon, 27 Aug 2007 17:54:18 -0400 Clark
from the village of (e-mail address removed)
felt we might be interested in the following...

I can't wait for my customers to Click it !!!

Shouldn't your customers have adequate anti-virus/malware software in
place though?

Cha Ching!!!

nuff said. Clearly someone who only pretends to be knowledgeable of
computers and security in order to cash in on their own incompetence
when their 'victims' have been misled.

Please die.

 

[Clark]

On Mon, 27 Aug 2007 17:54:18 -0400 Clark
from the village of (e-mail address removed)
felt we might be interested in the following...



Shouldn't your customers have adequate anti-virus/malware software in
place though?


nuff said. Clearly someone who only pretends to be knowledgeable of
computers and security in order to cash in on their own incompetence
when their 'victims' have been misled.

Please die.

LOL you ignorant whatever it is that you are.

Every single computer I work on has an antivirus and anti malware software
installed on them.
most of my customers have teenage kids that will click on and download
anything, and that's how they get infected.
Thank god for the reckless teenage bastards! I LOVE them!
(I make between $75 and $150 a repair).

Clark

 

[Drumstick]

LOL you ignorant whatever it is that you are.

Every single computer I work on has an antivirus and anti malware software
installed on them.
most of my customers have teenage kids that will click on and download
anything, and that's how they get infected.
Thank god for the reckless teenage bastards! I LOVE them!
(I make between $75 and $150 a repair).

Clark

You remind me of a car salesman my brother worked with who used to brag
about how upside down his customers were when they left in their new car
then he would cry because he didn't get any repeat business.

Drum--

 

[Clark]

LOL you ignorant whatever it is that you are.

You remind me of a car salesman my brother worked with who used to
brag about how upside down his customers were when they left in their
new car then he would cry because he didn't get any repeat business.

Drum--

Most of my business is repeat, trust me, I tell them how they get infected
and even print out the warnings from the F.B.I etc.
I can't help it that they cannot control their children, hell I even ask
them why does your 14 year old have broadband in their bedroom?
Then I warn them how dangerous the Internet is etc.,

They don't listen, so I go back 3 months later and clean up their systems
again.
I guess they can afford it.

Clark

 

[Dustin Cook]

Most of my business is repeat, trust me, I tell them how they get
infected and even print out the warnings from the F.B.I etc.
I can't help it that they cannot control their children, hell I even
ask them why does your 14 year old have broadband in their bedroom?
Then I warn them how dangerous the Internet is etc.,

They don't listen, so I go back 3 months later and clean up their
systems again.
I guess they can afford it.

Clark

3 months seems to be the average. I don't like the idea of malware
mind you, but the business for removing it is good. I see your point and
understand it Clark. Many of my customers also have a dumb look on their
face even after you explain how they got infected, and how to prevent it
from happening again. I suppose, they do like paying for repairs.

The few posters who responded to you obviously don't do this for a
living, or if they do, they have customers without teenage children.


--
####################################################
Dustin Cook
Author of BugHunter - MalWare Removal Tool - v2.2c
Email: (e-mail address removed)
Web..: http://bughunter.it-mate.co.uk
Pad..: http://bughunter.it-mate.co.uk/pad.xml
####################################################

 

[Dustin Cook]

I've seen this thing change group policy, expire passwords and modify
the boot.ini. Warning Newbie's don't go here or you will be asking for
help to get rid of it. 64_201_199_24 it arrives in email claiming to
be a youtube video. Dustin you like shit like this have fun.

I'm a bit behind on things here lately butts. If you want to send a sample
along to my email, your welcome to do so.


--
####################################################
Dustin Cook
Author of BugHunter - MalWare Removal Tool - v2.2c
Email: (e-mail address removed)
Web..: http://bughunter.it-mate.co.uk
Pad..: http://bughunter.it-mate.co.uk/pad.xml
####################################################

 

[kurt wismer]

F-Prot sez:
VIDEO.EXE Infection: Possibly a new variant of
W32/Fathom.3-based!Maximus

maximus? i guess the folks up at fsi didn't notice all the fuss symantec
had over bloodhound...

 

[/Tx2]

On Thu, 30 Aug 2007 01:16:27 GMT Dustin Cook
from the village of (e-mail address removed)
felt we might be interested in the following...

[...]

The few posters who responded to you obviously don't do this for a
living, or if they do, they have customers without teenage children.

I had a tremendously successful business dealing (in part) with exactly
what 'Clark' suggests requires 3 monthly visits, and rarely (if at all)
had any repeat business to customers with teenage children (having a 16
yr old myself).

A PC/user that are correctly configured/educated need not generate
repeat business in this way.

Indeed, i got more business through recommendation than i ever got
through repeat visits to a resurfaced problem.

Just demonstrating that it is NOT always that way Clark suggests it is,
and my experience of people like that is that they don't do a very good
job at the outset which secures them some repeat business further down
the line, or their competitors when the consumer becomes fed up with
keep calling them out.

I sold my business to a larger company after 5 years because I wanted a
change of direction in what I was doing, but became the top computer
services supplier in my county in that time.

 

[Clark]

On Thu, 30 Aug 2007 01:16:27 GMT Dustin Cook
from the village of (e-mail address removed)
felt we might be interested in the following...

[...]

The few posters who responded to you obviously don't do this for a
living, or if they do, they have customers without teenage children.

I had a tremendously successful business dealing (in part) with
exactly what 'Clark' suggests requires 3 monthly visits, and rarely
(if at all) had any repeat business to customers with teenage
children (having a 16 yr old myself).

I'm sorry, I did not suggest 3 month revisits, it just happens that way
sometimes
Most of my customers, I see them maybe twice a year, either software,
malware, or hardware issues
But I stand by the fact, that after I warn them and tell them how they get
infected (Bearshare etc)
or looking for free porn, or downloading "free" screensavers, They still get
infected.

Hell one customer, she was into online poker (that required her to install
software from the website)
It took me two hours to clean her system (and even found a rootkit)
Three days later she called me back with the same problems of infection,
sure enough she installed the very software I told her not to.
She stated to me that since I installed and updated antivirus, spybot,
adaware, and others
She thought she could just install anything because she was "protected"

Had to charge her another hour for the new infection, which was new, because
I never leave a customer without checking that the machine is really clean.

Clark

 

[Dustin Cook]

On Thu, 30 Aug 2007 01:16:27 GMT Dustin Cook
from the village of (e-mail address removed)
felt we might be interested in the following...

[...]

The few posters who responded to you obviously don't do this for a
living, or if they do, they have customers without teenage children.

I had a tremendously successful business dealing (in part) with exactly
what 'Clark' suggests requires 3 monthly visits, and rarely (if at all)
had any repeat business to customers with teenage children (having a 16
yr old myself).

A PC/user that are correctly configured/educated need not generate
repeat business in this way.

Indeed, I agree. However, when they insist on downloading, free
screensavers, online poker games, and new desktop themes, they usually
get something additional; despite being warned not to go for these
things.

Indeed, i got more business through recommendation than i ever got
through repeat visits to a resurfaced problem.

Same here. However, I do have a certain set of customers where on
average, every 3 months I have to pay them another visit.

Just demonstrating that it is NOT always that way Clark suggests it is,

I didn't mean to imply it was always like that, but it certainly can be.
Depends on the customer I suppose. Some of my customers follow
instructions well, and some do not.

and my experience of people like that is that they don't do a very good
job at the outset which secures them some repeat business further down
the line, or their competitors when the consumer becomes fed up with
keep calling them out.

Well, I don't mean to toot my own horn here, but I have no real incentive
to waste the gas to visit them again for the same issue. I usually don't
bill them if the same thing has occured, unless I find evidence of
bearshare or something being installed AFTER I was there the last time.

I sold my business to a larger company after 5 years because I wanted a
change of direction in what I was doing, but became the top computer
services supplier in my county in that time.

I worked for a respectable computer company here for the last 10 years
before deciding to go out on my own. I'm familiar with malware from a
programming standpoint as well as removal.


--
####################################################
Dustin Cook
Author of BugHunter - MalWare Removal Tool - v2.2c
Email: (e-mail address removed)
Web..: http://bughunter.it-mate.co.uk
Pad..: http://bughunter.it-mate.co.uk/pad.xml
####################################################

 

[Dustin Cook]

I've seen this thing change group policy, expire passwords and modify
the boot.ini. Warning Newbie's don't go here or you will be asking for
help to get rid of it. 64_201_199_24 it arrives in email claiming to
be a youtube video. Dustin you like shit like this have fun.

Hi again PcButts,

Any chance you will send the file for analysis?

If you will, you can send it to my gmail address if you will zip the file
(s), and encrypt them and rename the .zip to .dat or something so google
won't complain. I'd appreciate any cooperation from you that your willing
to give.


--
####################################################
Dustin Cook
Author of BugHunter - MalWare Removal Tool - v2.2c
Email: (e-mail address removed)
Web..: http://bughunter.it-mate.co.uk
Pad..: http://bughunter.it-mate.co.uk/pad.xml
####################################################

 

[pcbutts1]

You can get it from the link I posted.


--

Newsgroup Trolls. Read about mine here http://www.pcbutts1.com/downloads
The list grows. Leythos the stalker http://www.leythosthestalker.com, David
H. Lipman, Max M Wachtell III aka What's in a Name?, Fitz,
Rhonda Lea Kirk, Meat Plow, F Kwatu F, George Orwell

 

[Dustin Cook]

You can get it from the link I posted.

I cannot seem to gain access to anything at that address.
If you still have a viable sample of it and wouldn't mind sending it along
for analysis, I would appreciate it.


--
####################################################
Dustin Cook
Author of BugHunter - MalWare Removal Tool - v2.2c
Email: (e-mail address removed)
Web..: http://bughunter.it-mate.co.uk
Pad..: http://bughunter.it-mate.co.uk/pad.xml
####################################################

 

[pcbutts1]

I deleted it.

--

Newsgroup Trolls. Read about mine here http://www.pcbutts1.com/downloads
The list grows. Leythos the stalker http://www.leythosthestalker.com, David
H. Lipman, Max M Wachtell III aka What's in a Name?, Fitz,
Rhonda Lea Kirk, Meat Plow, F Kwatu F, George Orwell