Home page logo

Security Incidents mailing list archives

New email virus? [Free eurocalculator!!!]
From: Rik van Riel <riel () CONECTIVA COM BR>
Date: Tue, 3 Oct 2000 14:40:38 -0300


I've just gotten this spam, which contains the attachement
"eurocalculator.exe". Since I don't have any windows machines
around and know better than to execute random scripts I get,
I've limited myself to running strings on the file and I got
the following (and more):

--> Version: Back Orifice 2000 (BO2K) v%1.1u.%1.1u
Rebooting now.
Reboot attempt failed.
Locking up machine
%.100s [%.100s] (%.260s) "%.100s"  RO passwd:%.100s  RW passwd:%.100s  %s%s%s%s

and a bit further along the file a whole bunch of HTML crap
(is this standard BO2K or a custom thing for this one??):

<head><title>Network Neighborhood</title></head>

I also found a whole bunch of SMTP related strings, but maybe
those are BO2K related too.


In short, it seems that somebody is doing yet another attempt
at spreading BO2K through email ... possibly with the script
spreading itself, but I've only done a quick view of the file
and haven't looked at it in any detail ;)


"What you're running that piece of shit Gnome?!?!"
      -- Miguel de Icaza, UKUUG 2000

http://www.conectiva.com/               http://www.surriel.com/

---------- Forwarded message ----------
Date: Tue, 03 Oct 2000 17:15:15 GMT
From: Euro bank <euro_bank () hotmail com>
To: aephe () hotmail com
Subject: Free eurocalculator!!!

You got a free eurocalculator send to you by Euro_bank

An introduction to the Euro!

Get Your Private, Free E-mail from MSN Hotmail at http://www.hotmail.com.

Share information about yourself, create your own public profile at

  By Date           By Thread  

Current thread:
  • New email virus? [Free eurocalculator!!!] Rik van Riel (Oct 04)
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]