[linux] OT !!! VIRUS !!!
Jozef_Cierny na nts.sk
Jozef_Cierny na nts.sk
Čtvrtek Listopad 22 15:47:03 CET 2001
moc to sem nepatri,skor do konfery o viroch na m$, ale budiz, snad ma
neubiju:
I-Worm/Aliz
je starsi, 4 KB veliky komprimovany worm, ktery se siri jako prazdny HTML
mail s prilohou "whatever.exe" a subjektem poskladanym z techto
slov (z kazde skupiny vybere nahodne jedno slovo):
Fw:
Fw: Re:
Cool
Nice
Hot
some
Funny
weird
funky
great
Interesting
many
website
site
pics
urls
pictures
stuff
mp3s
shit
music
info
to check
for you
i found
to see
here
- check it
!!
!'
:-)
?!
hehe ;-)
V tele wormu je po dekomprimaci take viditelne nasledujici sdeleni:
:::iworm.alizee.by.mar00n!ikx2oo1:::
while typing this text i realize this text got added on many av
description sites, because this silly worm could be easily a
hype. i wonder which av claims '[companyname] stopped high risk
worm before it could escape!' or shit like that. heh, or they
boycot my virus because of this text. well, it is easy enough
for the poor av's to add this worm; since it was only released
as source in coderz#2... btw, loveletter*2 power in pure win32asm
and only a 4k exe file. heh, vbs kiddies, phear win32asm. :)
thx to: bumblebee!29a, asmodeus!ikx. greets to: starzer0!ikx
t-2000!ir, ultras!mtx & sweet gigabyte...
btw,burgemeester van sneek: ik zoek nog een baantje...
(alignmentfillingtext)
Rozesila se na adresy definovane v registry
'Software\Microsoft\WAB\WAB4\Wab File Name'
a pouziva defaultni SMTP ucet z registry
'Software\Microsoft\Internet Account Manager\Accounts\00000001'
Ke sve aktivaci vyuziva znamy trik s nespravne nastavenym Content-Type,
takze k jeho aktivaci muze za priznivych podminek dojit pouhym
prohlednutim zpravy. Worm nema zadnou skodlivou cinnost, ani se nezapisuje
do zadneho souboru, takze k jeho aktivaci dochazi pouze pri
spusteni z mailu a k jeho odstraneni staci infikovany mail smazat.
"Kocur"
<kocur na nocka.sk> To: <linux na lists.linux.sk>
Sent by: cc:
linux-admin na list Subject: Re: [linux] OT !!! VIRUS !!!
s.linux.sk
11/22/2001 02:23
PM
Please respond
to linux
na linuxe nebezi...
a mail server je zahlteni ras dva...
ten virus si kopiruje emailove adresy z adresarov a automaticky sa
rozposiela dalej...
ako priloha je vnom subor " whatever.exe "
uz teraz mam zahlteni mail server...
Další informace o konferenci linux