SV: new virus: (fwd)

["Peter Kruse" <kruse () krusesecurity dk>]

Hi Morning wood,

If we really need to post live samples to a list like this, I would
suggest, we do the following. 

It would be a lot better if you in the future store these samples on
your website and then drops in a URL instead. We have all already had
way to many copies of this worm. It´s simply waste of bandwidth. 

I really don´t want to get into a general discussion about posting
obvious malware on a public mailinglist like this. IMHO, code that has
already been described in details by Antivirus vendors should not be
sent out as an attachment (throw in an URL instead). I really don´t see
the point in sending out malware this way. Not even for testing ... Use
EICAR instead or other samples received from the wild.

The MD5 sum matches (b09e26c292759d654633d3c8ed00d18d) the original.
Nothing new here.

http://www.norman.com/virus_info/w32_swen_a_mm.shtml
http://www.kaspersky.com/click?_URL=http://www.viruslist.com/eng/virusli
st.html?id=88029
http://www.bitdefender.com/bd/site/virusinfo.php?menu_id=1&v_id=158
http://securityresponse.symantec.com/avcenter/venc/data/w32.swen.a () mm ht
ml
http://www.f-secure.com/v-descs/swen.shtml
http://us.mcafee.com/virusInfo/default.asp?id=description&virus_k=100662

BTW the attached zip containing Gibe-E (AKA Swen and Gibe-F) was not
password protected. 

Kind regards // Med venlig hilsen

Peter Kruse
CSIS / Kruse Security ApS
http://www.krusesecurity.dk

> -----Oprindelig meddelelse-----
> Fra: full-disclosure-admin () lists netsys com 
> [mailto:full-disclosure-admin () lists netsys com] På vegne af 
> morning_wood
> Sendt: 20. september 2003 08:45
> Til: full-disclosure () netsys com
> Emne: Re: [Full-Disclosure] new virus: (fwd)
>
>
> attatched virus spoofing microsoft network security update
> file is .zip password is "infected"
> email body follows....
> --------------- snip -----------------
> Microsoft Customer

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html