[linux] OT !!! VIRUS !!!

Jozef_Cierny na nts.sk Jozef_Cierny na nts.sk
Čtvrtek Listopad 22 15:47:03 CET 2001


moc to sem nepatri,skor do konfery o viroch na m$, ale budiz, snad ma
neubiju:

I-Worm/Aliz

je starsi, 4 KB veliky komprimovany worm, ktery se siri jako prazdny HTML
mail s prilohou "whatever.exe" a subjektem poskladanym z techto
slov (z kazde skupiny vybere nahodne jedno slovo):

 Fw:
 Fw: Re:


 Cool
 Nice
 Hot
 some
 Funny
 weird
 funky
 great
 Interesting
 many


 website
 site
 pics
 urls
 pictures
 stuff
 mp3s
 shit
 music
 info


 to check
 for you
 i found
 to see
 here
 - check it


 !!
 !'
 :-)
 ?!
 hehe ;-)


V tele wormu je po dekomprimaci take viditelne nasledujici sdeleni:

 :::iworm.alizee.by.mar00n!ikx2oo1:::

 while typing this text i realize this text got added on many av
 description sites, because this silly worm could be easily a
 hype. i wonder which av claims '[companyname] stopped high risk
 worm before it could escape!' or shit like that. heh, or they
 boycot my virus because of this text. well, it is easy enough
 for the poor av's to add this worm; since it was only released
 as source in coderz#2... btw, loveletter*2 power in pure win32asm
 and only a 4k exe file. heh, vbs kiddies, phear win32asm. :)
 thx to: bumblebee!29a, asmodeus!ikx. greets to: starzer0!ikx
 t-2000!ir, ultras!mtx & sweet gigabyte...
 btw,burgemeester van sneek: ik zoek nog een baantje...
 (alignmentfillingtext)


Rozesila se na adresy definovane v registry

'Software\Microsoft\WAB\WAB4\Wab File Name'

a pouziva defaultni SMTP ucet z registry

'Software\Microsoft\Internet Account Manager\Accounts\00000001'


Ke sve aktivaci vyuziva znamy trik s nespravne nastavenym Content-Type,
takze k jeho aktivaci muze za priznivych podminek dojit pouhym
prohlednutim zpravy. Worm nema zadnou skodlivou cinnost, ani se nezapisuje
do zadneho souboru, takze k jeho aktivaci dochazi pouze pri
spusteni z mailu a k jeho odstraneni staci infikovany mail smazat.






                                                                                                                       
                    "Kocur"                                                                                            
                    <kocur na nocka.sk>        To:     <linux na lists.linux.sk>                                             
                    Sent by:                cc:                                                                        
                    linux-admin na list        Subject:     Re: [linux] OT  !!! VIRUS !!!                                 
                    s.linux.sk                                                                                         
                                                                                                                       
                                                                                                                       
                    11/22/2001 02:23                                                                                   
                    PM                                                                                                 
                    Please respond                                                                                     
                    to linux                                                                                           
                                                                                                                       
                                                                                                                       




na linuxe nebezi...

a mail server je zahlteni ras dva...
ten virus si  kopiruje emailove adresy z adresarov a automaticky sa
rozposiela dalej...

ako priloha je vnom subor " whatever.exe "

uz teraz mam zahlteni mail server...








Další informace o konferenci linux