Hello Gregory, this is the virus "W32/Swen.A-mm"
Regards, Oliver Heinz ------------------------------------------------------------------------- | arago, | Oliver Heinz | | Institut fuer komplexes | Bereichsleiter Systembetrieb & Security | | Datenmanagement AG | eMail: [EMAIL PROTECTED] | | Am Niddatal 3 | | | 60488 Frankfurt am Main | http://www.arago.de/ | | Tel: +49-69-40568-401 | PGP-Fingerprint: a5de d4b4 46b3 4d8b 2646 | | Fax: +49-69-40568-111 | d4d0 e5fd d842 cc4e 7315 | ------------------------------------------------------------------------- On Wed, 19 Nov 2003, Gregory A. Gilliss wrote: > Date: Wed, 19 Nov 2003 21:23:59 -0800 > From: Gregory A. Gilliss <[EMAIL PROTECTED]> > To: [EMAIL PROTECTED] > Subject: Re: [Full-Disclosure] Another noxious M$ trojan > > For all who were interested in reviewing the suspect binaries, I have > posted them on my Web site: > > http://www.gilliss.com/greg/bin/awsqyf.zip > http://www.gilliss.com/greg/bin/update1991.zip > > The first is 52521 bytes and the second is 51529 bytes. Both executables, > when uncompressed, measure 106496 bytes. Each file expands to a Windows > .EXE file. > > These files are suspected MALWARE and should not be executed except under > controlled circumstances. I accept no responsibility for damages. > > BTW, I hope it's just another Gibe variant also...problem with running > UNIX and getting all these useless attachments >-) > > G > > > > -----Original Message----- > > From: Gregory A. Gilliss [mailto:[EMAIL PROTECTED] > > Sent: Wednesday, November 19, 2003 6:22 PM > > To: [EMAIL PROTECTED] > > Subject: [Full-Disclosure] Another noxious M$ trojan > > > > > > Hello all: > > > > Heads up - I received this in my mailbox this afternoon (Wednesday PST). > > > <SNIP> > > -- > Gregory A. Gilliss, CISSP E-mail: [EMAIL PROTECTED] > Computer Security WWW: http://www.gilliss.com/greg/ > PGP Key fingerprint 2F 0B 70 AE 5F 8E 71 7A 2D 86 52 BA B7 83 D9 B4 14 0E 8C A3 > > _______________________________________________ > Full-Disclosure - We believe in it. > Charter: http://lists.netsys.com/full-disclosure-charter.html > _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.netsys.com/full-disclosure-charter.html
