full-disclosure - [security] Social Eng. with Windows Media Player and Codec Download

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <90691a990601030844m36f2e60fte70f57d9d97671a1@mail.gmail.com>
Date: Tue Jan  3 16:44:21 2006
From: markoer at markoer.org (Marco Ermini)
Subject: [security] Social Eng. with Windows Media
	Player and Codec Download

On 12/28/05, Elia Florio <eflorio@...aster.it> wrote:
> Here:
> hXXp://www.goodmovielaugh.com/video5.html
> hXXp://www.good-movie-jokes.com/video5.html
>
> there's some malware/adware that try to use .ASX files as vector
> to infect windows machines by forcing users to download and install
> executables.
> The trick (not an exploit!!!!) is to convince people that Windows Media
> Player
> needs an additional codec....so that users confirm the download of an EXE
> file.
[...]
> The EXE file downloaded is probably some Download.Trojan or Trojan.Clicker
> packed with Nullsoft NSIS.
[...]

It was classified as "Trojan-Clicker.Win32.Bomka.a"


Cheers
--
Marco Ermini
Dubium sapientiae initium. (Descartes)
root@...an # mount -t life -o ro /dev/dna /genetic/research
(This message is for the designated recipient only and may contain
privileged or confidential information. If you have received it in
error, please notify the sender immediately and delete the original.)