Re: What is this

[trains () doctorunix com]

Quoting Armando Rogerio Brandão Guimaraes Junior <arjunior () attps com br>:

> Somebody know what fuck is this? http://www.pokersverige.se/IMAGE0004.php
> AntiVirus and SpyBot doesn´t detect!!!
>
> Armando Guimarães Jr

It is an MS-EXE executable program.  Anti virus doesn't find it because
it is not an virus.  Spybot for the same reason.  To block these you
need an smtp policy that does not allow executable attachments to
incoming emails.

"What it does" could be anything from typing "hello world" in a dialog
box (unlikely) to creating a new Administrator account on your
corporate AD server and posting the entire contents thereof to an IRC
channel (somewhat more likely).  But at first glance it looks like it
is going to open a backdoor shell on the recipient's PC.

tc



----------------------------------------------------------------
This message was sent using IMP, the Internet Messaging Program.

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/