[27706] in North American Network Operators' Group
Re: Trojan Alert was: Check this
daemon@ATHENA.MIT.EDU (Steven M. Bellovin)
Thu Mar 9 16:16:40 2000
From: "Steven M. Bellovin" <smb@research.att.com>
To: Kai Schlichting <kai@pac-rim.net>
Cc: nanog@merit.edu, shawn@smorris.com
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Date: Thu, 09 Mar 2000 16:00:34 -0500
Message-Id: <20000309210040.13AB041F16@SIGABA.research.att.com>
Errors-To: owner-nanog-outgoing@merit.edu
In message <4.2.2.20000309152159.00d31ea0@mail.speedus.net>, Kai Schlichting wr
ites:
>
> Can someone with a lucky hand in Visual Basic actually tell us what
> the trojan attachment we saw (LINKS2.VBS) we saw (full mail headers
> included, in case Shawn hasn't seen them yet) actually does.
> Seems to cloak itself well, and my Norton AV is *not* detecting anything.
>
There was a report on Bugtraq the other day that some AV programs don't look
at .VBS files. You may have to select 'check all files' or at least add .VBS
to your list of extensions to scan.
--Steve Bellovin
