RE: New IRC Trojan -Symantec and Trend Micro Unable To Stop Infection

From: Drew Copley (dcopley_at_eEye.com)
Date: 06/14/04

  • Next message: Greg A. Woods: "Re: Eudora SPAM Issues.."
    Date: Mon, 14 Jun 2004 10:47:14 -0700
    To: "Rusty Chiles" <rustychiles@cox.net>, <bugtraq@securityfocus.com>
    
    

     

    > -----Original Message-----
    > From: Rusty Chiles [mailto:rustychiles@cox.net]
    > Sent: Thursday, June 03, 2004 3:35 PM
    > To: bugtraq@securityfocus.com
    > Subject: New IRC Trojan -Symantec and Trend Micro Unable To
    > Stop Infection
    >
    > It seems that a new trojan is making the rounds on irc.
    > Nobody else seems to have figured it out yet, as there is no antivirus
    > pattern out.

    <snip>

    getRealShell -> http://62.131.86.111/analysis.htm

    Looks like straight from the aforementioned zero day spyware installer
    in the wild.

    This is pretty fast modification of the worm considering the spyware
    distributor likely did not do this.

    In fact, one is googled:
    http://www.google.com/search?hl=en&ie=UTF-8&q=getRealShell&btnG=Google+S
    earch

    Here's a free fix which I made ten months ago for the adodb issue which
    this and other vulnerabilities have used since then, re-released:

    http://www.eeye.com/html/research/alerts/AL20040610.html


  • Next message: Greg A. Woods: "Re: Eudora SPAM Issues.."