Full Disclosure mailing list archives
Re: Virus / Trojan
From: William Warren <hescomingsoon () verizon net>
Date: Fri, 09 Jan 2004 15:03:13 -0500
http://securityresponse.symantec.com/avcenter/venc/data/trojan.xombe.html Otero, Hernan (EDS) wrote:
Today found this suspicious file attached to an email, obviously is a virus (our AV donĀ“t detect it :-( ). The virus/trojan is very simple, the developer only put effort in obfuscate the strings inside the binary. The executable file try to connect to gamemaniacs.org and download a file. This file will be located in the system directory The url used in the GET is: gamemaniacs.org /download/get.php?dist=2 This will download the binary saved as msvchost.exe any one know what virus/trojan is this? -H<<VIRUS1_DETECTED_AND_REMOVED_winxp_sp1_VIRINFO.TXT>>------------------------------------------------------------------------ 01/09/2004 03:47 PM The original attachment contains a virus or meets the File-Blocking rules. ScanMail took action: winxp_sp1.zip/Moved, please see your Exchange Server administrator for details!
-- May God Bless you and everything you touch.My "foundation" verse: Isaiah 54:17 No weapon that is formed against thee shall prosper; and every tongue that shall rise against thee in judgment thou shalt condemn. This is the heritage of the servants of the LORD, and their righteousness is of me, saith the LORD.
_______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.netsys.com/full-disclosure-charter.html
Current thread:
- Virus / Trojan Otero, Hernan (EDS) (Jan 09)
- Re: Virus / Trojan Exibar (Jan 09)
- Re[2]: Virus / Trojan Papp Geza (Jan 09)
- Re: Virus / Trojan Axel Pettinger (Jan 09)
- Re: Virus / Trojan William Warren (Jan 09)
- Re: Virus / Trojan Nick FitzGerald (Jan 09)
- <Possible follow-ups>
- RE: Virus / Trojan Nicolas CARTRON (Jan 09)
- RE: Virus / Trojan John LaCour (Jan 09)
- Re: Virus / Trojan PhilZ (Jan 15)
- Re: Virus / Trojan Koito Triabva (Jan 15)
- Re: Virus / Trojan Exibar (Jan 09)