Not exactly a new idea ... :) http://www.symantec.com/avcenter/venc/data/w32.welchia.worm.html
At 07:54 PM 8/26/2003 -0700, you wrote:
I like that idea very much...
----- Original Message ----- From: "John Tolmachoff (Lists)" <[EMAIL PROTECTED]> To: <[EMAIL PROTECTED]> Sent: Tuesday, August 26, 2003 1:56 PM Subject: RE: [Declude.Virus] Sobig, the next wave?
Ok, this calls for a white hat virus creator.
A virus that will infect all these unpatched computers, and the only thing it does is create a big bold red popup every 15 minutes that says Patch your computer, you dummy.
John Tolmachoff MCSE CSSA Engineer/Consultant eServices For You www.eservicesforyou.com
> -----Original Message----- > From: [EMAIL PROTECTED] [mailto:Declude.Virus- > [EMAIL PROTECTED] On Behalf Of R. Scott Perry > Sent: Tuesday, August 26, 2003 1:44 PM > To: [EMAIL PROTECTED] > Subject: RE: [Declude.Virus] Sobig, the next wave? > > > >People a typically unaware that their machine is infected - because it > >continues to function perfectly. > > That is very true. > > We infected a computer in our virus lab with Sobig.F, and you couldn't tell > anything unusual was happening. The file didn't seem to do anything when > it was run (so the recipient probably figures that the attachment didn't > get downloaded or something like that, and probably won't even say "Yes, I > ran the program" when asked by an admin), and the only noticeable > differences on the system were a couple extra registry entries and system > files (files in the \Winnt directory and \Winnt\system32 directory), and a > program running in Task Manager (something like "winsst32.exe" that doesn't > look unusual). > > People who are infected probably would have a somewhat slower Internet > connection, but that's probably about all they would notice. > > -Scott > --- > Declude JunkMail: The advanced anti-spam solution for IMail mailservers. > Declude Virus: Catches known viruses and is the leader in mailserver > vulnerability detection. > Find out what you have been missing: Ask for a free 30-day evaluation. > > --- > [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] > > --- > This E-mail came from the Declude.Virus mailing list. To > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > type "unsubscribe Declude.Virus". The archives can be found > at http://www.mail-archive.com.
--- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
--- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.Virus". The archives can be found at http://www.mail-archive.com.
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
--- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.Virus". The archives can be found at http://www.mail-archive.com.
--- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
--- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.Virus". The archives can be found at http://www.mail-archive.com.
