Feeds

Worm blocks access to The Register

Gunsan fires poison pellet

  • alert
  • submit to reddit

Internet Security Threat Report 2014

Having trouble accessing The Register lately? It may not be your crap porn filter, or the ebone shutdown spilling over into DNS error reports at several ISPs. You may need deworming.

For virus writers have created a worm which, among other tricks, blocks access to El Reg.

The Gunsan is a mass-mailing worm which infects local drives and network shares. On infected machines, it opens a backdoor that allows a cracker to control the computer using IRC.

Gunsan has spread modestly since its discovery late last month. It deletes files needed by antivirus and firewall products (including all files that contain mcafee, softice, numega, antivirus, anti-virus, win32dasm, sophos, catsclaw, claw95, lockdown, symantec, firewall, virusscan, virus-scan, fprot, f-prot, zone labs, or atguard in their path). Gunsan only affects Windows PCs and can cause system instability by deleting important system files.

The worm also alters the \%Windows\Hosts file, which contains DNS configuration information, and modifies it so that the names of AV Web sites - and The Register - so that they are resolved to the address of the local computer.

It's the first worm we're aware of that stops infected users reading the Register.

Gunsan spreads by sending itself along with another e-mail message to all e-mail addresses it collects on the infected machine. Infected messages normally come with a subject header containing a single space character and an infected attachment 'Test.exe'.

Users are advised to update their antivirus software to detect the worm and to resist the temptation to open unsolicited email attachments.

Bootnote

And in entirely unrelated news, a Cambridge, UK company called Mathworks has developed a new electronic horsewhip - called The Register.

This "has been developed to allay growing criticism over cruelty to animals in racing.

The whip has sensors in its tip that can measure and record each blow, with MathWorks MATLAB technology reading the electronic signals."

A couple of readers have asked us if this is a tribute to the UK's most popular IT website. We don't think so, but if it is, it's a bloody weird one.

We recently came across a sex site called PronPost which is carrying an ad for Reg Recruitment because, the webmaster explains "i like the register... just thought i'd send some traffic your way ;)".

Every little helps. ®

External Links

Write up of Gunsan by Symantec

Top 5 reasons to deploy VMware with Tegile

More from The Register

next story
Regin: The super-spyware the security industry has been silent about
NSA fingered as likely source of complex malware family
Why did it take antivirus giants YEARS to drill into super-scary Regin? Symantec responds...
FYI this isn't just going to target Windows, Linux and OS X fans
Privacy bods offer GOV SPY VICTIMS a FREE SPYWARE SNIFFER
Looks for gov malware that evades most antivirus
Home Office: Fancy flogging us some SECRET SPY GEAR?
If you do, tell NOBODY what it's for or how it works
HACKERS can DELETE SURVEILLANCE DVRS remotely – report
Hikvision devices wide open to hacking, claim securobods
'Regin': The 'New Stuxnet' spook-grade SOFTWARE WEAPON described
'A degree of technical competence rarely seen'
Syrian Electronic Army in news site 'hack' POP-UP MAYHEM
Gigya redirect exploit blamed for pop-rageous ploy
Astro-boffins start opening universe simulation data
Got a supercomputer? Want to simulate a universe? Here you go
prev story

Whitepapers

10 ways wire data helps conquer IT complexity
IT teams can automatically detect problems across the IT environment, spot data theft, select unique pieces of transaction payloads to send to a data source, and more.
Getting started with customer-focused identity management
Learn why identity is a fundamental requirement to digital growth, and how without it there is no way to identify and engage customers in a meaningful way.
How to determine if cloud backup is right for your servers
Two key factors, technical feasibility and TCO economics, that backup and IT operations managers should consider when assessing cloud backup.
Reg Reader Research: SaaS based Email and Office Productivity Tools
Read this Reg reader report which provides advice and guidance for SMBs towards the use of SaaS based email and Office productivity tools.
Security and trust: The backbone of doing business over the internet
Explores the current state of website security and the contributions Symantec is making to help organizations protect critical data and build trust with customers.