Re: Remote Shell Trojan: Threat, Origin and the Solution

From: Patrick Andry (pandryat_private)
Date: Mon Sep 10 2001 - 10:38:40 PDT

  • Next message: Matt Block: "RE: Remote Shell Trojan: Threat, Origin and the Solution"

    Kevin Gagel wrote:
    
    >Has any expert c programers examined the c code to see if it actually
    >does what the remarks say?
    >I am suspicious of anything that is posted anonymously no matter how
    >well it's documented. I 
    >don't know C well enough to tell if the documentation is accurately
    >portraying what the code is
    >really doing.
    >
    >If it's not then this a one very well crafted "socially engineered"
    >virus...
    >
    The best I can tell, it isn't reading in any weird strings.  The most it 
    looks like it's doing is removing parts of the file in 4k chunks.
    Can anyone else verify this?
    
    
    
    ----------------------------------------------------------------------------
    This list is provided by the SecurityFocus ARIS analyzer service.
    For more information on this free incident handling, management 
    and tracking system please see: http://aris.securityfocus.com
    



    This archive was generated by hypermail 2b30 : Mon Sep 10 2001 - 10:43:49 PDT