full-disclosure - [ok] Possible Virus/Trojan

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <004001c473dd$aa6c7de0$fc11010a@msad.brookshires.net>
From: toddtowles at brookshires.com (Todd Towles)
Subject: [ok] Possible Virus/Trojan

Hey guys, 

I was able to finally get the file out of Outlook via add-on. The add-on
moves file types from Level 1 to Level 2. Anyways, it wasn't detected as a
virus and it is only 35 KBs in size. Kinda small. 

I planned on breaking it apart..but I went to the bar last night. 

I have sent it to a couple of people, maybe it was just someone messing with
me.

-Todd

-----Original Message-----
From: full-disclosure-admin@...ts.netsys.com
[mailto:full-disclosure-admin@...ts.netsys.com] On Behalf Of Peter Kruse
Sent: Tuesday, July 27, 2004 4:31 AM
To: Denis McMahon; fd
Subject: SV: [ok] [Full-Disclosure] Possible Virus/Trojan

Hi,

>> I heard about a small thing going around about Bin Laden hanging himself
>> and some CNN reporters had pictures. But it was a virus. I didn't hear
>> much about it, maybe it is a small time thing and they are just picking
>> people to spread the virus around.

Was posted to many newsgroups during the past two weeks.

Subject: Osama Found Hanged

Content:
Osama Bin Ladin was found hanged by two CNN journalists early Wedensday
evening. As evidence they took several photos, some of which i have
included here. As yet, this information has not hit the headlines due
to Bush wanting confirmation of his identity but the journalists have
released some early photos over the internet..

xxxxxxxxx.x-y.net/OsamaFoundDead.zip

The URL points to a zip fil that contains a small backdoor/trojan in the
HackArmy family.

>I've seen that with both bin-laden and arnie, containing a link to a
>website hosting the executable with the virus.

Yes, it has also been posted as Brittney nude and stuff like that.
The Arnie thing can be found on Sophos website:
http://www.sophos.com/virusinfo/articles/arnie.html

Kind regards
Peter Kruse
http://www.csis.dk

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html