P2P

[andsome]

"Science is organized knowledge. Wisdom is organized life."

Immanuel Kant (1724-1804); German philosopher.

- Malicious code and P2P file sharing networks -

Oxygen3 24h-365d, by Panda Software (http://www.pandasoftware.com)

Madrid, October 22, 2003 - More and more viruses are using peer-to-peer

(P2P) file sharing networks and clients as a means of transmission. Today in

Oxygen3 24h-365d, we are going to look at how they do this and the basic

security measures to adopt in order to protect computers.

P2P networks allow users to collaborate and exchange information via the

Internet. For example, this type of architecture can be used to resolve

complicated tasks that require high calculation power, by sharing the load

across several computers connected to one another. The formula that is most

popular with Internet users is the one that allows them to exchange files,

using programs like KaZaA, eDonkey or eMule.

These applications act as a client and a server at the same time, allowing

users to share files with the rest of the users while downloading any files

they want. Due to the popularity of these applications, virus authors have

identified them as a new way of transmitting their creations. A recent

example is Gibe.C, which as well as spreading via e-mail, IRC, and local

networks, also spreads via KaZaA. In order to spread through this P2P

program, Gibe.C follows the following routine.

1) The worm creates several infected files in the KaZaA directory used to

share files with other users. In order to trick other users into downloading

these files, it assigns them names that suggest that they contain useful

programs, movies, games, music, latest versions of software, etc.

2) This worm spreads to other computers when a user, using the search

function included in P2P programs, finds and downloads one of these infected

files. When the user opens the infected file, the computer will be infected

and the worm will create copies of itself in the shared directory of the P2P

program, thereby turning it into another source of infection.

Although infected files can be detected before they are downloaded observing

certain details -such as a smaller size when the content of the file should

occupy various megabytes- you cannot guarantee that a file is virus free by

simply looking at it. For this reason, effective and completely updated

protection that scans all the files you download is still the best

protection tool.

For further information about Gibe.C and other malicious code, visit Panda

Software's Virus Encyclopedia at:

http://www..pandasoftware.com/virus_info/encyclopedia

NOTE: The address above may not show up on your screen as a single line.

This would prevent you from using the link to access the web page. If this

happens, just use the 'cut' and 'paste' options to join the pieces of the

URL.

------------------------------------------------------------

The 5 viruses most frequently detected by Panda ActiveScan, Panda Software's

free online scanner: 1) Bugbear.B, 2) Blaster; 3) Parite.B; 4) Gibe.C; 5)

Klez.I.

------------------------------------------------------------

To unsubscribe from Oxygen3 24h-365d, please visit:

http://www.pandasoftware.com/unsubscribe.asp

To contact with Panda Software, please visit:

http://www.pandasoftware.com/about/contact/

[Guest Shirley_Crabtree]

Thanks for the excellent linkage to SCARE-MONGERING.

I have been using p2p software for the last 2 years and have NEVER been infected through it.

I've been porn-bombed and had my home-page hijacked through various search-engines (non-porn)...I've had virus's sent through e-mail.(just malicious!!) but I've NEVER had ANY problems WHATSOEVER with P2P software!!!

Lucky me lol :D

Shirl.

PS the idiots are the people who download things like HL2.exe from Kazaa (135 Kbs)...Any .exe file is a gamble on P2P!!

Are you an idiot???!!!!

I'd say no...but there are plenty about

[Redhat]

Classic Example :

R Kelly Album (REAL!! NO VIRUS!!).mp3.exe