lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  linux-cve-announce  PHC 
Open Source and information security mailing list archives
 
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [day] [month] [year] [list]
Message-ID: <EC24D5FB-EAD7-11D7-BC90-000393C34F68@mac.com>
From: smearp at mac.com (Sean Earp)
Subject: Re: New virus?

To quote the Symantec write-up (FWIW they have some great screen shots 
of the virus email and installation/infection) at 
<http://www.sarc.com/avcenter/venc/data/w32.swen.a@mm.html>

"The worm can also impersonate mail delivery failure notices, attaching 
itself as a randomly named executable.

One example is:

I'm sorry I wasn't able to deliver your message to one or more 
destinations."



On Friday, September 19, 2003, at 09:00 AM, 
full-disclosure-request@...ts.netsys.com wrote:

> Yes, it's swan virus.
>
> --
> Eero
>
> If you meant swen, this doesn't look like swen. Nothing mentioning
> micro$oft
>
> The test of the email is :
>>
>> Hi.
>> I'm sorry to have to inform you that I wasn't able to deliver your
>> message to the following addresses:
>>
>>
>>
>> Undelivered message to rlfblncx@...foot.net


Powered by blists - more mailing lists

Powered by Openwall GNU/*/Linux Powered by OpenVZ