[68055] in North American Network Operators' Group
Re: Possibly yet another MS mail worm
daemon@ATHENA.MIT.EDU (Todd Vierling)
Mon Mar 1 09:34:17 2004
Date: Mon, 1 Mar 2004 09:32:59 -0500 (EST)
From: Todd Vierling <tv@duh.org>
To: Curtis Maurand <curtis@maurand.com>
Cc: nanog@merit.edu
In-Reply-To: <Pine.LNX.4.44.0403010914170.14567-100000@ns1.mainelinesys.com>
Errors-To: owner-nanog-outgoing@merit.edu
On Mon, 1 Mar 2004, Curtis Maurand wrote:
: > It's annoying how easily these things spread even though they don't rely on
: > a specific OS vulnerabililty -- hell, it's an executable *in a zipfile*, so
: > it requires opening the zipfile and then running the program inside it. Of
: > course everyone will run it, even though it's named dygfwefuih.exe (random
: > characters before .exe). <grumble>
:
: Sure they do....its called COM/DCOM/OLE/ActiveX or whatever they
: want to call it this week. Its on every windows system.
No, my point was that the majority of newer trojan mail viruses don't depend
on ActiveX exploits -- they simply wait, dormant, for a n00b to click on
this mysterious-looking Zip Folder, and the mysterious-looking EXE inside.
It's as if the modern e-mail viruses are closer to human infections. Only
the clueful are immune. 8-)
--
-- Todd Vierling <tv@duh.org> <tv@pobox.com>
