Re: sndvol.exe

["Ryan Russell" <Ryan.Russell () sybase com>]

Yea, the Bulgarians have been creating trojans to
attack a Bulgarian ISP they don't like.  I think
this one was e-mailed to people pretenting
to be "Your Internet Explorer Updgrade"
I think the executable was IE1099.EXE or something
similar.  A web search or check with the antivirus
vendors ought to turn it up.

I also believe most of the antivirus vendors will catch
it if you;ve got the latest versions.

                         Ryan





"Randy Garbrick" <garbrir () hotmail com> on 03/18/99 04:33:06 PM

Please respond to "Randy Garbrick" <garbrir () hotmail com>

To:   firewall-wizards () nfr net
cc:    (bcc: Ryan Russell/SYBASE)
Subject:  sndvol.exe




Has anyone noticed a Trojan horse called sndvol.exe that replaces the
Win NT/9X sndvol.exe and then does a continuous port scan from inside a
firewall to multiple outside addresses?  It created a denial of service
by maxing out the sessions on our Pix.  We're trying to locate the
source of the executable.


Randy Garbrick

Get Your Private, Free Email at http://www.hotmail.com