[33345] in bugtraq
Re: new WIN virus?
daemon@ATHENA.MIT.EDU (Gregor Lawatscheck)
Tue Feb 3 01:30:16 2004
Message-ID: <4019C9C1.7050003@mpex.net>
Date: Fri, 30 Jan 2004 04:04:33 +0100
From: Gregor Lawatscheck <gpel@mpex.net>
MIME-Version: 1.0
To: "Atom 'Smasher'" <atom@suspicious.org>, bugtraq@securityfocus.com
In-Reply-To: <Pine.BSF.4.58.0401290056100.39640@erfrnepu.fhfcvpvbhf.bet>
Content-Type: text/plain; charset=us-ascii; format=flowed
Content-Transfer-Encoding: 7bit
Atom 'Smasher' wrote:
[...]
> the original spam, the page that it requests, and the suspicious "exe"
> file:
> http://smasher.suspicious.org/tmp/live-virus.tgz
>
[...]
> updatte.exe was tested on:
> yahoo-mail
> http://www.kaspersky.com/remoteviruschk.html
> http://www.dials.ru/english/www_av/
> http://www.rav.ro/scan/indexn.php
> and they all reported that the file poses no threat. i suspect they're
> wrong.
I've submitted this file to AVERT WebImmune ( https://www.webimmune.net
) and they now detect it as
a password phishing Trojan called "pws-polk". I've also sent a sample to
newvirus (at) kaspersky.com so they get a chance to update their signatures.
- Gregor
