Full Disclosure mailing list archives
RE: A worm...
From: "Richard M. Smith" <rms () computerbytesman com>
Date: Thu, 26 Jun 2003 07:54:38 -0400
This is the first worm that I am aware of that hides itself inside of a .ZIP file. This trick prevents the worm executable from being deleted by the Outlook Security Update. Looks like Microsoft will need to now think about how to deal with malicous code inside of attached .ZIP files. Outlook 2002 does provide a security warning when opening the .ZIP file. But everyone knows that .ZIP files are safe, right? I don't believe there is any security warning when running the .PIF file inside of the .ZIP, but I didn't try this particular experiment. ;-) Richard -----Original Message----- From: full-disclosure-admin () lists netsys com [mailto:full-disclosure-admin () lists netsys com] On Behalf Of KF Sent: Wednesday, June 25, 2003 9:11 PM To: full-disclosure () lists netsys com Subject: Re: [Full-disclosure] A worm... I believe Simon is well aware of what virus this is... the question was in relation to the zipping of the payload. I believe he was wondering if this (zipping of payload) was some new Antivirus evasion trick or if there was something more to it (like simply hoping a retarded user would unzip and run the .pif).
I know what it is, but since when did the pif worm start zipping
itself?
did I miss something?
-KF _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.netsys.com/full-disclosure-charter.html _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.netsys.com/full-disclosure-charter.html
Current thread:
- A worm... ATD (Jun 25)
- RE: A worm... Phillip A Jaeger (Jun 25)
- RE: A worm... gml (Jun 25)
- <Possible follow-ups>
- Re: A worm... golddog (Jun 25)
- Re: A worm... KF (Jun 25)
- Re: A worm... ATD (Jun 25)
- RE: A worm... Richard M. Smith (Jun 26)
- SV: A worm... Peter Kruse (Jun 26)
- RE: A worm... Richard M. Smith (Jun 26)
- RE: A worm... ATD (Jun 26)
- Re: A worm... Nexus (Jun 26)
- Re: A worm... ATD (Jun 26)
- RE: A worm... Richard M. Smith (Jun 26)
- RE: A worm... Ron DuFresne (Jun 26)
- Re: A worm... Roy S. Rapoport (Jun 26)
- Re: A worm... KF (Jun 25)
- Re: A worm... morning_wood (Jun 26)
- SV: A worm... Peter Kruse (Jun 26)