full-disclosure - SV: new virus: (fwd)

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <000201c37f85$4465b540$0202a8c0@teliahomebase>
From: kruse at krusesecurity.dk (Peter Kruse)
Subject: SV: new virus: (fwd)

Hi Morning wood,

If we really need to post live samples to a list like this, I would
suggest, we do the following. 

It would be a lot better if you in the future store these samples on
your website and then drops in a URL instead. We have all already had
way to many copies of this worm. It?s simply waste of bandwidth. 

I really don?t want to get into a general discussion about posting
obvious malware on a public mailinglist like this. IMHO, code that has
already been described in details by Antivirus vendors should not be
sent out as an attachment (throw in an URL instead). I really don?t see
the point in sending out malware this way. Not even for testing ... Use
EICAR instead or other samples received from the wild.

The MD5 sum matches (b09e26c292759d654633d3c8ed00d18d) the original.
Nothing new here.

http://www.norman.com/virus_info/w32_swen_a_mm.shtml
http://www.kaspersky.com/click?_URL=http://www.viruslist.com/eng/virusli
st.html?id=88029
http://www.bitdefender.com/bd/site/virusinfo.php?menu_id=1&v_id=158
http://securityresponse.symantec.com/avcenter/venc/data/w32.swen.a@mm.ht
ml
http://www.f-secure.com/v-descs/swen.shtml
http://us.mcafee.com/virusInfo/default.asp?id=description&virus_k=100662

BTW the attached zip containing Gibe-E (AKA Swen and Gibe-F) was not
password protected. 

Kind regards // Med venlig hilsen

Peter Kruse
CSIS / Kruse Security ApS
http://www.krusesecurity.dk

> -----Oprindelig meddelelse-----
> Fra: full-disclosure-admin@...ts.netsys.com 
> [mailto:full-disclosure-admin@...ts.netsys.com] P? vegne af 
> morning_wood
> Sendt: 20. september 2003 08:45
> Til: full-disclosure@...sys.com
> Emne: Re: [Full-Disclosure] new virus: (fwd)
> 
> 
> attatched virus spoofing microsoft network security update
> file is .zip password is "infected"
> email body follows....
> --------------- snip -----------------
> Microsoft Customer