RE: Re: pnp worm unknown variant - post infectionactions

["Aditya Deshmukh" <aditya.deshmukh () online gateway strangled net>]

> > Very good points, but can you think of another worm that
> downloaded XXX
> > spyware/adware ?
>
> I can't give you a specific name -- when I first saw it it didn't
> strike me as any more significant than the warez and porn FTP servers
> I'd seen years earlier, so didn't make specific note of it -- but there
> have been many.  We see new bots every day (many dozen a week) that are
> issued orders on joining the C&C network to install all manner of
> adware, spyware, click-for-dosh agents and so on.  Among those there
> will be many things dealing in "XXX" content but often analysis doesn't
> even go so far as checking that the target URL is still reachable...

> From :
http://netrn.net/spywareblog/archives/2005/01/03/more-on-adware-installed-th
ough-windows-media-files/

I installed the same WMA file on an old Win ME box with no protection except
AVG free and the free version of Zone Alarm. I ended up with 11 desktop
shortcuts for everything from "Get This Weeks Deals from Dell" to "Get Sex
Toys Direct", "Hot Facial xxx Shots", and so on.

From:
http://forums.spywareinfo.com/lofiversion/index.php/t30275.html
she said, "It may be associated with an unwanted autostarting Internet
Explorer trying to install a Hot-SeXXX toolbar."

Adaware has a list of spyware which shows a lot of them display XXX popups -
maybe some them just started showing something what you wanted in your
senario....

If you want any specific names I would dig further - just mail me off list



________________________________________________________________________
Delivered using the Free Personal Edition of Mailtraq (www.mailtraq.com)
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/