Nmap Security Scanner
*Intro
*Ref Guide
*Install Guide
*Download
*Changelog
*Book
*Docs
Security Lists
*Nmap Hackers
*Nmap Dev
*Bugtraq
*Full Disclosure
*Pen Test
*Basics
*More
Security Tools
*Pass crackers
*Sniffers
*Vuln Scanners
*Web scanners
*Wireless
*Exploitation
*Packet crafters
*More
Site News
Site Search:
Exploit World
Advertising
About/Contact
Credits
Sponsors:
edgeos



Full Disclosure: Virus / Trojan

Virus / Trojan

From: Otero, Hernan (EDS) <HOtero_at_lanchile.cl>
Date: Fri, 9 Jan 2004 15:47:43 -0400

Today found this suspicious file attached to an email, obviously is a virus
(our AV donīt detect it :-( ). The virus/trojan is very simple, the
developer only put effort in obfuscate the strings inside the binary.

The executable file try to connect to gamemaniacs.org and download a file.
This file will be located in the system directory

The url used in the GET is:

gamemaniacs.org /download/get.php?dist=2
 
This will download the binary saved as msvchost.exe

any one know what virus/trojan is this?

-H

 <<VIRUS1_DETECTED_AND_REMOVED_winxp_sp1_VIRINFO.TXT>>

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html

Received on Jan 09 2004
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]
edgeos