full-disclosure - HEADS UP VIRUS BEING SPREAD one of our rea

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <0HFF00EKXG1M49@smtp2.clear.net.nz>
From: nick at virus-l.demon.co.uk (Nick FitzGerald)
Subject: HEADS UP VIRUS BEING SPREAD one of our rea

<scheidell@...nap.net> wrote:

> did a google for update880.exe, found nothing yet.

Dude -- ever hear (or think) of self-mailers generating random 
attachment names to make them less immediately identifiable?

And here's a real shocker of an idea (though not actually relevant in 
this case) -- imagine if it was a _parasitic_ file infector!

It is an existing, well-known (and "old") virus, reliably ID'ed by 
just about any virus scanner updated since late Feb this year.  There 
are abundant informed and informative descriptions of how it works 
all over the web.  It seems Mr Wood and your good self must be about 
the only "security experts" who have not already encountered it.

-- 
Nick FitzGerald
Computer Virus Consulting Ltd.
Ph/FAX: +64 3 3529854