My apologies to the members of the list, and especially to Andrew Jenkins.

It appears that the trojan I picked up must have come from elsewhere. I have 
tried reopening the schematic file in question and cannot repeat being 
infected.
 
It must have been a coincidence that the trojan showed itself at the moment I 
opened the schematic. I run a fairly secure system here with a hardware and 
software firewall. I also run active virus checking on every executable file 
written to my system. It's hard (but not impossible) for someone to have 
deposited a trojan on my system. It also may have been here, but dormant, for 
some time. It could have activated itself or something I did at the time may 
have activated it as well.

Again, my sincere apologies for the false alarm.

Matt Pobursky
Maximum Performance Systems 

On Tue, 13 Feb 2001 01:22:00 -0600, Matt Pobursky wrote:
>Andrew,
>
>I hope it really WAS just a screwup and nothing malicious. Just for grins, I 
>went ahead and opened the schematic file on an isolated machine and found that
>it delivered a nifty little trojan...
>
>I just got done cleaning my system and documenting what I found along the way.
>It did appear to be benign, but was a little disturbing nonetheless. It 
>appeared to deliver a "phone home" type trojan as it places an application in 
>the system startup (and a few other places) that attempts to go out to the 
>'net. (Thanks ZoneAlarm!) It kind of smelled like a DDOS client to me. Any 
>comments?
>
>Anyone else on the list who might open this file by mistake and want details 
>of 
>what I found -- please feel free to contact me directly.
>
>Matt Pobursky
>Maximum Performance Systems
>

Matt Pobursky
Maximum Performance Systems

They that can give up essential liberty to obtain a little temporary
safety deserve neither liberty nor safety. --Benjamin Franklin, 1759
"Don't Tread On Me!"




* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * *
*  This message sent by: PROTEL EDA USERS MAILING LIST
*
*  Use the "reply" command in your email program to
*  respond to this message.
*
*  To unsubscribe from this mailing list use the form at
*  the Association web site. You will need to give the same
*  email address you originally used to subscribe (do not
*  give an alias unless it was used to subscribe).
*
*  Visit http://www.techservinc.com/protelusers/subscrib.html
*  to unsubscribe or to subscribe a new email address.
* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * *

________________________________________________________

To leave the EDAFORUM discussion list, send a email with
'leave edaforum' in the body to '[EMAIL PROTECTED]'

More Information : http://www.dolist.net

Reply via email to