full-disclosure - new virus: (fwd)

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <Pine.LNX.4.44.0309192046390.3252-100000@dogbert.localdomain>
From: dantams at danieltams.dyndns.org (Daniel Tams)
Subject: new virus: (fwd)

On Fri, 19 Sep 2003, Ron Clark wrote:

> 
> 
> ---------- Forwarded message ----------
> Date: Fri, 19 Sep 2003 18:22:00 +0300
> From: Eero Volotinen <security@...g.org>
> To: Ron Clark <ron@...mail.Armstrong.EDU>
> Subject: Re: [Full-Disclosure] new virus:
> 
> Yes, it's swan virus.
> 
> --
> Eero
> 
> If you meant swen, this doesn't look like swen. Nothing mentioning
> micro$oft

Today I received a copy of both emails and they both came from the same
host within a 15 minute interval. That makes me also believe that they are
connected somehow.

Maybe a computer infected by either worm will propagate using both types?

Return-Path: <info@...essrental.com>
Delivered-To: dantams@...ieltams.dyndns.org
Received: (qmail 13136 invoked from network); 19 Sep 2003 18:01:13 -0000
Received: from kellylake96-79.cyberbeach.net (HELO 
mail.personainternet.com) (216.104.96.79)
  by ratbert.danieltams.dyndns.org with SMTP; 19 Sep 2003 18:01:13 -0000
Received: (qmail 5864 invoked from network); 19 Sep 2003 18:00:56 -0000
Received: from unknown (HELO xdzodhgt) ([24.139.19.217])
          (envelope-sender <info@...essrental.com>)
          by mail.personainternet.com (qmail-ldap-1.03) with SMTP
          for <cwage@...nteight.com>; 19 Sep 2003 18:00:56 -0000
FROM: "Microsoft Security Bulletin" <sftrlxuiylqcma@...sletters.msn.net>
TO: "Customer" <okyq_cfrnzhu@...sletters.msn.net>
SUBJECT: New Net Upgrade
Mime-Version: 1.0
Content-Type: multipart/mixed; boundary="knpuhfthdimw"

Return-Path: <info@...essrental.com>
Delivered-To: dantams@...ieltams.dyndns.org
Received: (qmail 21824 invoked from network); 19 Sep 2003 18:14:32 -0000
Received: from kellylake96-79.cyberbeach.net (HELO 
mail.personainternet.com) (216.104.96.79)
  by ratbert.danieltams.dyndns.org with SMTP; 19 Sep 2003 18:14:32 -0000
Received: (qmail 12395 invoked from network); 19 Sep 2003 18:14:16 -0000
Received: from unknown (HELO wyxpcpmu) ([24.139.19.217])
          (envelope-sender <info@...essrental.com>)
          by mail.personainternet.com (qmail-ldap-1.03) with SMTP
          for <payal-bsd@...ticky.com>; 19 Sep 2003 18:14:16 -0000
FROM: "" <xmailservice@...mail.com>
TO: "Internet Recipient" <user@...lserver.net>
SUBJECT: Error Advice
Mime-Version: 1.0
Content-Type: multipart/alternative;
        boundary="dmpkrr"

- Daniel