full-disclosure - Re: pnp worm unknown variant

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <!~!UENERkVCMDkAAQACAAAAAAAAAAAAAAAAABgAAAAAAAAA0BKn9uKnWEeCDU7Vx+IAQ8KAAAAQAAAAWH8k3BhDlUaly6arcrztNQEAAAAA@online.gateway.strangled.net>
Date: Wed Aug 17 09:09:08 2005
From: aditya.deshmukh at online.gateway.strangled.net (Aditya Deshmukh)
Subject: Re: pnp worm unknown variant - post
	infectionactions

> > Very good points, but can you think of another worm that
> downloaded XXX
> > spyware/adware ?
>
> I can't give you a specific name -- when I first saw it it didn't
> strike me as any more significant than the warez and porn FTP servers
> I'd seen years earlier, so didn't make specific note of it -- but there
> have been many.  We see new bots every day (many dozen a week) that are
> issued orders on joining the C&C network to install all manner of
> adware, spyware, click-for-dosh agents and so on.  Among those there
> will be many things dealing in "XXX" content but often analysis doesn't
> even go so far as checking that the target URL is still reachable...

>From :
http://netrn.net/spywareblog/archives/2005/01/03/more-on-adware-installed-th
ough-windows-media-files/

I installed the same WMA file on an old Win ME box with no protection except
AVG free and the free version of Zone Alarm. I ended up with 11 desktop
shortcuts for everything from "Get This Weeks Deals from Dell" to "Get Sex
Toys Direct", "Hot Facial xxx Shots", and so on.

From:
http://forums.spywareinfo.com/lofiversion/index.php/t30275.html
she said, "It may be associated with an unwanted autostarting Internet
Explorer trying to install a Hot-SeXXX toolbar."

Adaware has a list of spyware which shows a lot of them display XXX popups -
maybe some them just started showing something what you wanted in your
senario....

If you want any specific names I would dig further - just mail me off list



________________________________________________________________________
Delivered using the Free Personal Edition of Mailtraq (www.mailtraq.com)