Re: [ok] [Full-Disclosure] Possible Virus/Trojan

From: Andrew Farmer (andfarm_at_teknovis.com)
Date: 07/26/04

  • Next message: VX Dude: "Re: [Full-Disclosure] (no subject)" 
    To: "Curt Purdy" <purdy@tecman.com>
Date: Sun, 25 Jul 2004 16:05:53 -0700

    On 25 Jul 2004, at 12:06, Curt Purdy wrote:
    > Todd Towles wrote:
    >> I received an e-mail today that looked very much like a virus. Here
    >> is the message
    >>
    >> Attachment - erupts.avi.exe
    >
    >> Subject - New Southern California wildfire erupts
    >
    > <snip>
    >
    >> Either this is a new Trojan that changes it body and subject based on
    >> the current AP news or someone used a very lame trick against me.
    >> =)
    >
    > I'm guessing the latter. Although story scraping would be possible,
    > intellegent naming of the .exe would not be. Most likely a friend...
    > or
    > enemy.

    Sure it would be. In this case, at least, the executable is just named
    based on the last word of the headline plus ".avi.exe".

    _______________________________________________
    Full-Disclosure - We believe in it.
    Charter: http://lists.netsys.com/full-disclosure-charter.html

  • Next message: VX Dude: "Re: [Full-Disclosure] (no subject)"