lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  PHC 
Open Source and information security mailing list archives
 
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
From: hescomingsoon at verizon.net (William Warren)
Subject: Virus / Trojan

http://securityresponse.symantec.com/avcenter/venc/data/trojan.xombe.html

Otero, Hernan (EDS) wrote:

>Today found this suspicious file attached to an email, obviously is a virus
>(our AV don?t detect it :-( ). The virus/trojan is very simple, the
>developer only put effort in obfuscate the strings inside the binary.
>
>The executable file try to connect to gamemaniacs.org and download a file.
>This file will be located in the system directory
>
>The url used in the GET is:
>
>gamemaniacs.org /download/get.php?dist=2
> 
>This will download the binary saved as msvchost.exe
>
>any one know what virus/trojan is this?
>
>
>
>-H
>
>
> <<VIRUS1_DETECTED_AND_REMOVED_winxp_sp1_VIRINFO.TXT>> 
>  
>
>------------------------------------------------------------------------
>
>01/09/2004 03:47 PM The original attachment contains a virus or meets the File-Blocking rules. ScanMail took action: winxp_sp1.zip/Moved, please see your Exchange Server administrator for details!
>

-- 
May God Bless you and everything you touch.

My "foundation" verse: 
Isaiah 54:17 No weapon that is formed against thee shall prosper; and every tongue that shall rise against thee in judgment thou shalt condemn. This is the heritage of the servants of the LORD, and their righteousness is of me, saith the LORD.


Powered by blists - more mailing lists