Rick's b.log - 2010/07/04
It is the 21st of November 2024 You are 3.144.48.72, pleased to meet you!

Virus? Rootkit? Or bad joke?

Anybody come across something like this?

I know it is notoriously difficult to detect a rootkit from within the infected machine, and I still cannot be 100% certain; however it seems odd that such a message would pop up. What kind of stealthy crim advertises their presence?!?
It also seems odd that such a thing might use YouTube as a vector. Videos are reencoded, possibly because of the issues surrounding Flash. In addition, the website layout is fairly minimal and well controlled. Hiding something there, I'd have thought, would be difficult. And it would need to reside within YouTube itself, else NoScript would have blocked it.

So my current thinking is it is most likely that somebody, somehow, managed to get a message to pop up. But I only have 50% confidence in that. Nothing seems amiss, but that could well be the point... Or... Maybe it was a genuine attack designed to kill the MBR and destroy the partitioning information, only my computer uses the EFI system, not MBR... Who can say? It's been through a power cycle so I know that much is alright.

Your comments:

Rob O'Donnell, 5th July 2010, 16:04

It's an XSS scripting vulnerability in YouTube Comments. Should be fixed now. And I thought you ran with NoScript?    Oh, and you really should read El Reg before you panic :-)  http://www.theregister.co.uk/2010/07/05/youtube_xss_chaos/

Rick, 5th July 2010, 16:21

Hi!  So it was just some dopey scripting message? Phew!    I do run with NoScript, but YouTube has permission - kinda doesn't work well without! Luckily if the payload (if any?) was off-site, it will have been blocked.    I *did* read El Reg, but note the article referred was posted at 9am, about three hours after my scans were completed, and some 16-odd hours after this b.log posting.    Useful, anyway, to prompt me to give my system the once over. Not what I planned to do on a Sunday, but never mind.    Thanks, Rob, for the quick response.

Rob, 5th July 2010, 17:53

Ah, the blog post only popped up in my RSS reader shortly before I posted! Never thought to check the relative times..

Rick, 5th July 2010, 18:43

After leaving the scanning active through the night, I had two matches - with the development folder for Alarm containing a file called "AlDelay.exe" which is apparently infected by "Win32:Dropper-CLB [Trj]".  This is actually a generic virus warning, with AlDelay scoring in the heuristics. I wiped the file (just in case), but AlDelay is actually a program that waits for 15 seconds before running Alarm proper - this being an attempt to get Alarm to show up correctly on the system tray [this is a known bug in XP - see http://winhlp.com/node/16]. Avast thought it was trojan-like. Fair dues. ☺  Other than that, all checked out okay. Phew!