Hi Morning wood, If we really need to post live samples to a list like this, I would suggest, we do the following.
It would be a lot better if you in the future store these samples on your website and then drops in a URL instead. We have all already had way to many copies of this worm. It�s simply waste of bandwidth. I really don�t want to get into a general discussion about posting obvious malware on a public mailinglist like this. IMHO, code that has already been described in details by Antivirus vendors should not be sent out as an attachment (throw in an URL instead). I really don�t see the point in sending out malware this way. Not even for testing ... Use EICAR instead or other samples received from the wild. The MD5 sum matches (b09e26c292759d654633d3c8ed00d18d) the original. Nothing new here. http://www.norman.com/virus_info/w32_swen_a_mm.shtml http://www.kaspersky.com/click?_URL=http://www.viruslist.com/eng/virusli st.html?id=88029 http://www.bitdefender.com/bd/site/virusinfo.php?menu_id=1&v_id=158 http://securityresponse.symantec.com/avcenter/venc/data/[EMAIL PROTECTED] ml http://www.f-secure.com/v-descs/swen.shtml http://us.mcafee.com/virusInfo/default.asp?id=description&virus_k=100662 BTW the attached zip containing Gibe-E (AKA Swen and Gibe-F) was not password protected. Kind regards // Med venlig hilsen Peter Kruse CSIS / Kruse Security ApS http://www.krusesecurity.dk > -----Oprindelig meddelelse----- > Fra: [EMAIL PROTECTED] > [mailto:[EMAIL PROTECTED] P� vegne af > morning_wood > Sendt: 20. september 2003 08:45 > Til: [EMAIL PROTECTED] > Emne: Re: [Full-Disclosure] new virus: (fwd) > > > attatched virus spoofing microsoft network security update > file is .zip password is "infected" > email body follows.... > --------------- snip ----------------- > Microsoft Customer _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.netsys.com/full-disclosure-charter.html
