lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  PHC 
Open Source and information security mailing list archives
 
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [thread-next>] [day] [month] [year] [list]
From: aditya.deshmukh at online.gateway.technolabs.net (Aditya , ALD [ Aditya Lalit Deshmukh ])
Subject: Possible New Malware....

BlankHi List, Possible new malware makes startup entries and copies itself to the windows folder this is where it was found, creates a CurruntPowerProfile reg startup key with a value of Rundll32.exe,powrprof.dll,LoadCurrentPwrScheme2.exe cant find anything else that it is doing except that it is written in VB anyone willing to have a look at it ? the files are attached as they are just ~ 40 KB  -aditya ( simply ren *.txt to *.exe ) 
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.grok.org.uk/pipermail/full-disclosure/attachments/20040823/f0de91f5/attachment.html
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: image/gif
Size: 145 bytes
Desc: not available
Url : http://lists.grok.org.uk/pipermail/full-disclosure/attachments/20040823/f0de91f5/attachment.gif
-------------- next part --------------
An embedded and charset-unspecified text was scrubbed...
Name: Rundll32.exe,powrprof.dll,LoadCurrentPwrScheme2.txt
Url: http://lists.grok.org.uk/pipermail/full-disclosure/attachments/20040823/f0de91f5/Rundll32.exepowrprof.dllLoadCurrentPwrScheme2.txt
-------------- next part --------------
An embedded and charset-unspecified text was scrubbed...
Name: RunDLL32e.txt
Url: http://lists.grok.org.uk/pipermail/full-disclosure/attachments/20040823/f0de91f5/RunDLL32e.txt

Powered by blists - more mailing lists