mailing list archives
Re: Warning to Bugtraq posters.
From: smiths () TIAC NET (Richard M. Smith)
Date: Thu, 23 Dec 1999 15:59:17 -0500
Okay, this is probably the NewApt worm/trojan/virus. Here are
some descriptions of it:
Trend Micro Description
NAI Avert Description
The NTBugTraq mailing list had the same problem last week.
All it takes is one person on a mailing list to get infected,
then it sends itself off to people who have posted messages to
the list. For example, I got a WinApt message from Italy that was a
reply to a message I posted in August to NTBugTraq.
An interesting side note, NewApt contains an IP address
for a Microsoft Web server that shows the www.microsoft.com
homepage. Not sure what the purpose of this address is
in the code.
From: Bugtraq List [mailto:BUGTRAQ () SECURITYFOCUS COM]On Behalf Of Steven
Sent: Wednesday, December 22, 1999 11:49 AM
To: BUGTRAQ () SECURITYFOCUS COM
Subject: Warning to Bugtraq posters.
After my last post to bugtraq (Re: w00w00....) I received a message
pertaining to be from myself with the same subject line. The messsage
contained an attachment program named goal.exe. It claimed that this
program was from messagemates.com. If the program is run it will give an
error message about an unfound .DLL. It will also create a new
"C:\WINNT\" and an entry in the registry named "tpawen" with the value
"C:\WINNT\goal.exe /x" under
. I don't
know what this program is, I am disassembling it now and will post again
later. The header from the message I received indicates that the mail was
received by my mail server from "stu.chesapeake.net, 188.8.131.52". If
anyone knows anything more please email me.