phpBB Destroyer

[Sonic 296]

On one of my regular visits to the official phpBB site I noticed this news. Some sort of nasty virus/worm doing the rounds called "phpBB Destroyer".

Originally posted at: http://www.phpbb.com/phpBB/viewtopic.php?f=14&t=260546

 

We've had reports from people concerned about an application calling itself "phpBB Destroyer". The website on which this app can be found claims the author is "fed up" with phpBB's security problems and has released this "application" as a consequence. The website contains supposed screenshots of said application and lists its capabilities.

 

We have been examining this application and the following details have emerged.

 

# It is malware, it contains what appears to be a Netsky related worm.

 

# It contains no application which can be used to damage phpBB installations.

 

# When executed it will extract itself into a subfolder within system32. It will then attempt to patch XP SP2 (if appropriate) to overcome the limitation on simultaneous connections Microsoft put in place. It will also alter your registry and insert a new key which will run another file in that subfolder (csrss.exe) upon boot. Once rebooted (it will do this automatically if possible) the fake csrss.exe will be run. Now there is a legitimate csrss present in your system32 folder, do not confuse the two Smile Your process list should typically show only one csrss.exe process, usually as the SYSTEM user. If you have two or more csrss.exe instances, particularly if they are running under your account you probably have been infected. This fake csrss will attempt to connect to what appears to be an IRC bot. Based on the behaviour of Netsky it likely then proceed to mail itself to any addresses it can find in files it has scanned on your system.

 

# At present no AV definitions detect this application. The application has been submitted to all the major AV vendors as a precaution.

 

I say again, this application has absolutely nothing to do with phpBB. It cannot be used to damage phpBB (to the best of our available knowledge). It appears to be a program designed to "attack" those who would download such an application to cause harm.

 

If you have been affected by this application ... well ... why were you running something that claimed to "attack" phpBB installations? Wink To remove it you can try following the general removal directions for the AB variant of Netsky. You should be looking for any suspicious entries for csrss.exe in a subfolder of system32. Do not, I repeat, do not remove any references from the registry which refer to the system32/csrss.exe unless you have extremely good reason to believe it has been replaced! XP users should disable System Restore and all users should run in Safe Mode during the recovery period.

 

As with any worm, ensure your virus definitions are up to date (though as noted they may not detect this issue at the present time), you have an effective firewall (ingress and egress!) and you have installed all relevant updates for your OS (that includes Linux et al ... irrespective of this worm all OS's have suffered vulnerabilities in key applications).

 

We will not handle any support requests related to this application. It has absolutely nothing to do with us ... indeed as an application claimed to damage phpBB installations we are, quite obviously, not inclined to help anyone infected by it.

[Mario 0]

i'll be sure to look out 4 it and take measures to stop it

[Luk3us 63]

Ok....

[Tree 0]

i'll be sure to look out 4 it and take measures to stop it

 

you obviously didnt read the article...

 

 

:roll:

[Mario 0]

i did an as long as i update my virus definitions i'll be ok

[Sonic 296]

Its one of those "I'm so stupid I downloaded something I thought was cool and screwed up my computer with it" things.

You would have to be a complete moron to get infected by this.

 

Why do you think virues, worms and trojans spread around the internet? Because people are are dumb, they surf along, blindy clicking links all day, downloading junk, movies and porn on their high speed connections that their rich Daddy pays for, and never take the time to install and update anti-virus software :roll:

 

How hard is these days to update your PC with the latest patches for Windows or your anti-virus software? Its so simple the damn thing does it for you.

[Luk3us 63]

I only ever get those hijacker scripts. Thats about it for me....

 

I wish I had I had a high speed connection my Daddy pays for... :cry: :cry:

[Sonic 296]

I only ever get those hijacker scripts. Thats about it for me....

Then stop using IE and switch to Firefox.

[Mario 0]

i already did

[chickendippers 1]

Sonic was talking to luk3us :roll:

[Mario 0]

1 prob with firefox is it can be really slow

[Luk3us 63]

Yeah thats why I use IE. It starts faster than firefox. Hmm.... I don't know, I might switch over...

[Mario 0]

but it can be really useful tho keeping all ur bookmarks in alphabetical order

[chickendippers 1]

Firefox is much faster than IE, especially with a few optimisations I made.

 

The reason Firefox takes an extra second to load up compared with IE is because IE has components continually running in the background - Firefox loads these from scratch.

After waiting that excruciating extra second to load Firefox you don't need to close it again - the wonders of tabbed browsing

[Luk3us 63]

Tabbed browsing ain't that amazing. Besides I never have more than 10 pages open at any time anyway.

[Mario 0]

tabbed browsing?

[chickendippers 1]

Tabbed browsing: http://www.kipling.me.uk/tabbed.jpg

I have 3 pages open, but only one thing open in the taskbar.

 

If I had 10 IE windows open + all the other programs running, i'd nva be able to switch betwen them easilly - tabbed browsing really speeds up your surfing and general computer use + it uses up a lot less recources.

[Mario 0]

right ok

[Sonic 296]

Hey chickendippers, how come your Firefox has the Windows icon in the top left corner and on the taskbar?

[Thierry 0]

Windows 98 maybe

[Luk3us 63]

If I had 10 IE windows open + all the other programs running, i'd nva be able to switch betwen them easilly

 

 

Alt - Tab

[chickendippers 1]

Hey chickendippers, how come your Firefox has the Windows icon in the top left corner and on the taskbar?

Yup, Windows 98.

 

Alt - Tab sux0res, it's the slowest way of flipping between windows.

[Mario 0]

nah it aint

[Doctor Destiny 41]

The taskbar is far more efficient unless you click the wrong window. Alt-Tab is good for going between two windows but not an array of them.

[Luk3us 63]

Alt - Tab sux0res, it's the slowest way of flipping between windows.

 

Yes. But its faster when you have to many windows open and you can't see the little caption name on the taskbar....

 

Besides I like using the keyboard more than the mouse.