Security Incidents mailing list archives

New Trojan?


From: Foo dE Bar <mhallacy () MERCURY XTRATYME COM>
Date: Mon, 4 Dec 2000 12:20:58 -0600

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1


Howdy, I've been getting a ton of bounced email to postmaster@ from our
dialup users, it appears to be a new trojan (I've been unable to find any
info on it online):


Content:

- -----

Date: Sun, 3 Dec 2000 21:17:52 -0600
From: Hahaha <hahaha () sexyfun net>
Subject: Snowhite and the Seven Dwarfs - The REAL story!

Today, Snowhite was turning 18. The 7 Dwarfs always where very educated
and
polite with Snowhite. When they go out work at mornign, they promissed a
*huge* surprise. Snowhite was anxious. Suddlently, the door open, and the
Seven
Dwarfs enter...


    [ Part 3.2, Application/OCTET-STREAM (Name: "midgets.scr")  31KB. ]
    [ Cannot display this part. Press "V" then "S" to save in a file. ]

- ------

I've chosen not to attach the file, but you can download it from:

http://www.poptix.net/midgets.scr (Windows users, please be careful.)

The attachment name changes, the only reason I've been getting copies of
it is because a lot of our users seem to have bad addresses in their MSOE
address books, (and from that, I can surmise that it's sending to everyone
in these peoples address books).

Input would be appreciated.



                        Matthew S. Hallacy
                        XtraTyme Technologies

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.0.2 (GNU/Linux)
Comment: For info see http://www.gnupg.org

iD8DBQE6Kw8cyECZjIgidSERAhPZAJ93cRWeC9F/oF/woNkDQRTWMrroPgCfevFp
AqRs4W6ZsZaBUA10HiYaVLo=
=mGIK
-----END PGP SIGNATURE-----


----- End forwarded message -----


Current thread: