full-disclosure - Possible New Malware

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <b7bc1b1f0409140942156bad63@mail.gmail.com>
From: uberguidoz at gmail.com (GuidoZ)
Subject: Possible New Malware

www.VirusTotal.com will run it through quite a few all at once. You
can also do them individually if you like - search the archives for
the exact addresses.

-- 
Peace. ~G


On Tue, 14 Sep 2004 10:26:09 -0500, Ty Bodell <tebodell@...il.com> wrote:
> Kaspersky has one,
> 
> http://www.kaspersky.com/scanforvirus
> 
> --Tebodell
> 
> 
> 
> 
> ----- Original Message -----
> From: Perrymon, Josh L. <perrymonj@....com>
> Date: Tue, 14 Sep 2004 09:02:13 -0500
> Subject: [Full-Disclosure] Possible New Malware
> To: full-disclosure@...ts.netsys.com
> 
> Anyone Heard of BackDoor-CIW?
> 
> This is a piece of malware with the .exe of winstr32.exe that is
> causing 99% CPU on a couple machine at a remote location. I found that
> one infected machine does not have MS04-11 patched. So that could be
> an attack vector.
> 
> I get no luck googling for the .exe or BackDoor-CIW   <----  This is
> what Postini identifies the file as.
> 
> I'm trying to get a copy to put in my VMWare Lab.
> 
> Also----   Isn't there a website that we can email this file to and it
> will run several AV solutions on it to find more info?
> 
> Joshua Perrymon
> Sr. Network Security Consultant
> 
> PGP Fingerprint
> 51B8 01AC E58B 9BFE D57D  8EF6 C0B2 DECF EC20 6021
> 
> **********CONFIDENTIALITY NOTICE**********
> The information contained in this e-mail may be proprietary and/or
> privileged and is intended for the sole use of the individual or
> organization named above.  If you are not the intended recipient or an
> authorized representative of the intended recipient, any review, copying
> or distribution of this e-mail and its attachments, if any, is prohibited.
> If you have received this e-mail in error, please notify the sender
> immediately by return e-mail and delete this message from your system.