Fwd: [da] PR for the MSN worm

[RLVaughn <Randy_Vaughn () BAYLOR EDU>]

This is a forwarded message
From: Gadi Evron <gadi () tehila gov il>
To: da () linuxbox org
Date: Monday, March 7, 2005, 9:18:19 AM
Subject: [da] PR for the MSN worm

===8<==============Original message text===============
Let's not repeat past mistakes, here is PR I will send a couple of very
tech-savvy reporters (and friends). Feel free to send it out as well. It
is not an official "press release".


You will probably already be aware of the first part of this message. I
hope this will interest you.

This night, information came about an MSN messenger worm that spread by
sending the following message:
"http://home.earthlink.net/~gallery10/omg.pif lol! see it! u'll like it"

I would estimate millions got infected.

Once going to that page, the Trojan horse was downloaded onto your PC,
and in turn it downloaded three other Trojan horses, also hosted at
Earthlink.

One of them then proceeded to connect to a botnet command and control
IRC server.

Due to international cooperation between ISP's, AV companies and CERTs
on a secure and vetted drone armies and malicious web sites coordination
group, all the sites and the C&C IRC server were killed by their
authoritative owner.

Taking the sites down effectively stopped the spread of the worm, and
killing the C&C assured that the infected users won't be later used as a
group for illegal purposes such as DDoS, spam, etc. We go into action
when worms go out.

This was done in a very short time, and while there were no signatures
yet for this worm from AV companies.

Please run by me what you have before you do something with it, if you
do. I will also be available at home via ge () linuxbox org, so CC: it if
you want a response when I go home.

Thanks.

I am available on my cell phone via +972-50-5428610. I'd rather not be
quoted... I don't like the attention.
_______________________________________________
da mailing list
da () linuxbox org
https://linuxbox.org/cgi-bin/mailman/listinfo/da
===8<===========End of original message text===========



--
Best regards,
Randal Vaughn

**********
Participation and subscription information for this EDUCAUSE Discussion Group discussion list can be found at 
http://www.educause.edu/groups/.