full-disclosure - Email Harvesting virus?

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <3F823AE4.2080002@thievco.com>
From: BlueBoar at thievco.com (Blue Boar)
Subject: Email Harvesting virus?

Joel R. Helgeson wrote:

> A customers machine appears to be infected with some type of malware 
> that apparently harvests email addresses and puts them into a file named 
> '~'.  Just the tilde ~, no extention.  This file is created under the 
> C:\Documents and Settings\%username%\~.  I have attached a zipped copy 
> of the file for refrence.
>  
> I came across the file earlier today, renamed it and copied it off to a 
> keychain USB drive for later analysis. Well, the file re-created itself 
> and the malware creating it is not immediately apparent.  I've scanned 
> all the running apps but I haven't had much time to investigate.
>  
> Any ideas?

Microsoft Word? :) It appears to be one of the backup files that Word makes 
while you are working.

						BB