full-disclosure - Re: patch-9449

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date: Fri, 13 Apr 2007 12:59:05 -0400
From: Mike Shafer <news-letter-subs@...-secured.com>
To: Steward Smith <fulldisc@...ll.org>
Cc: full-disclosure@...ts.grok.org.uk
Subject: Re: patch-9449

Myself and a client have received several over the past 24hrs.

I submitted one as the password protected zip file to VirusTotal and 
Kaspersky identified it as a virus/trojan as did several other AV 
products. Names varied so I didn't record them. Was most interested in 
seeing if there was a consistent identification of the archive.

Received another this morning which I unzipped on a Linux box  then 
tested with CA AV. It was identified as Win32/Pecoan.R

- Mike Shafer

Steward Smith wrote:
> Hi,
>
> Had a funny spam today that warned about mails coming from my IP address
> and I should apply the attached patch. The filename was named
> patch-9449.exe which was attached in a password protected zip file -
> presumably to fool your virus scanner.

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/