bugtraq - Re: new WIN virus?

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date: Fri, 30 Jan 2004 04:04:33 +0100
From: Gregor Lawatscheck <gpel@...x.net>
To: Atom 'Smasher' <atom@...picious.org>, bugtraq@...urityfocus.com
Subject: Re: new WIN virus?

Atom 'Smasher' wrote:
[...]
> the original spam, the page that it requests, and the suspicious "exe"
> file:
> 	http://smasher.suspicious.org/tmp/live-virus.tgz
> 
[...]
> updatte.exe was tested on:
>    yahoo-mail
>    http://www.kaspersky.com/remoteviruschk.html
>    http://www.dials.ru/english/www_av/
>    http://www.rav.ro/scan/indexn.php
> and they all reported that the file poses no threat. i suspect they're
> wrong.

I've submitted this file to AVERT WebImmune ( https://www.webimmune.net 
) and they now detect it as
a password phishing Trojan called "pws-polk". I've also sent a sample to 
newvirus (at) kaspersky.com so they get a chance to update their signatures.

- Gregor