Re: CRIME New worm swen

From: Todd Ellner (tellner@private)
Date: Fri Sep 19 2003 - 09:35:40 PDT

  • Next message: Jordan Gackowski: "Re: CRIME New worm swen"

    
    >It looks damn legit. If I was not normally paranoid, and a bit
    >surprised Microsoft would send me a patch, then I could have thought it
    >legit. Remember, I am *supposed* to be one of the clueful ones :) I
    >imagine a lot of users will click on this. It seemed to escape the mail
    >filter, but not the local file scanner. A slight lag in virus
    >updates......
    
    I got it this morning. It looked good. But whoever sent it hadn't bothered
    to spoof the return address to something from microsoft.com. And the
    attached file had a tiny little name - not like the long ones MS usually
    uses. I left it in the inbox on my ISP's server just for fun. When I POPed
    the message speakeasy recognized the payload as a virus. Good for speakeasy.
    
     
    >It is a virus. Microsoft *never* emails updates. The patch name was
    >update93.exe. I am not sure if that is consistent.
    
    The one that showed up in my mailbox was something like qxeydl.exe
     
    



    This archive was generated by hypermail 2b30 : Fri Sep 19 2003 - 10:20:46 PDT