full-disclosure - Gibe (was Re: new virus:)

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20030919131536.E8452@ns1.exotope.com>
From: disclosure at exotope.com (disclosure@...tope.com)
Subject: Gibe (was Re: new virus:)

My H+BEDV AntiVir is alerting on both the Swen virus (bogus Microsoft
patch) and this variant, tagging them both as Gibe.C.1

This version doesn't mention any patch.  It seems more closely related
to the older Gibe variants.

Here's the text/html from the new 'bounce' variant:
-<snip>----------------------------------------------------------
<HTML>
<HEAD></HEAD>
<BODY>
<iframe src=3D"cid:awirev" height=3D0 width=3D0></iframe>
<BR><BR>Hi.
<BR>This is the qmail program<BR>
<BR><BR><BR>Undelivered mail to <B>user@...mple.com</B>
</BODY></HTML>

-<snip>--------------------------------------------------------

I'm also seeing 'bounce' versions of Gibe.C.1 with .bat attachments
instead of .exe (though the filetype is still an exe).

                      ...Eric

On Fri, 19 Sep 2003, Ron Clark wrote:

>
> Has anyone seen an email going around with subject bug message
> containing a supposed audio attachment that is really an exe named
> ckcwr.exe.
>
> Is this a possible new virus? I have recieved numerous cpoies of this
> email since last night.
>
> Ron Clark
> System Administrator
> Armstrong Atlantic State University
>
> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter: http://lists.netsys.com/full-disclosure-charter.html
>