Re: Suspicious JOe.exe

From: Sould3mon (Sould3monat_private)
Date: Fri Aug 03 2001 - 20:28:26 PDT

  • Next message: denis: "Re: slackware permissions"

    i am on dalnet were simmelair  files are being sended on join of channels
    these files are named <somthingto-do-with-sex>.mpeg.zip
    in it there was 1 exe file
    what i found in it was
    inclear text
    
    <ircserver> <port> <channel> <pass>  notice <nick> newvic
    
    the actual line copy & pasted
    
    ...bind........backdoored.mine.nu 6667 #vics penile notice ntman newvics
    
    this an other .exe  sended on dalnet to me
    ...bind.........ipz.mine.nu.6667.#ip.notice wicked.freshy
    
    both irc servers do not exist not at the time i tested them
    in this zobie version both were in clear text   i think the notice part
    also counts for  the joe.exe
    but it could be any msg :/
    but in this version it came right after the network + port
    
    ( i do not know if anyone already mailed this 1  my first day in this mail
    group i am sorry if it was)
    



    This archive was generated by hypermail 2b30 : Fri Aug 03 2001 - 20:56:15 PDT