full-disclosure - Re: pnp worm unknown variant

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <43033684.31897.AFCB0DDE@localhost>
Date: Wed Aug 17 02:07:46 2005
From: nick at virus-l.demon.co.uk (Nick FitzGerald)
Subject: Re: pnp worm unknown variant - post infection
	actions

Jason Coombs to me:

> Very good points, but can you think of another worm that downloaded XXX 
> spyware/adware ?

I can't give you a specific name -- when I first saw it it didn't 
strike me as any more significant than the warez and porn FTP servers 
I'd seen years earlier, so didn't make specific note of it -- but there 
have been many.  We see new bots every day (many dozen a week) that are 
issued orders on joining the C&C network to install all manner of 
adware, spyware, click-for-dosh agents and so on.  Among those there 
will be many things dealing in "XXX" content but often analysis doesn't 
even go so far as checking that the target URL is still reachable...

-- 
Nick FitzGerald
Computer Virus Consulting Ltd.
Ph/FAX: +64 3 3267092