bugtraq - malware effecting broadband users in Israel

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <41C9583F.2000202@tehila.gov.il>
Date: Wed, 22 Dec 2004 13:19:27 +0200
From: Gadi Evron <gadi@...ila.gov.il>
To: bugtraq@...urityfocus.com
Subject: malware effecting broadband users in Israel

I got reports from several fellow ISP's here in Israel about this
happening, originally on an Israeli ISP's security information sharing list.

The dialer configuration is being modified, from "advanced" to "Basic",
a random host and the user name are changed to <random number>username
and some say it also effects the Local Connection settings.
The users see error numbers; 734 ,769, 789 or 800.

Rumors have it, this thing is from Kazaa.

Rumored process names from an online paper article, are:
chksp2.exe, sp2ctr.exe and glwgmgeb.exe.

Also from that article, this link has been provided, although it's
relevance isn't clear:
http://www.sophos.com/virusinfo/analyses/trojdlucam.html

I haven't yet got my hands on a sample to study this further.

-- 
Gadi Evron,
Information Security Manager, Project Tehila -
Israeli Government Internet Security.
Ministry of Finance, Israel.

gadi@...ila.gov.il
Office: +972-2-5317890
Fax: +972-2-5317801
http://www.tehila.gov.il