Domain: viruslist.com
Stories and comments across the archive that link to viruslist.com.
Comments · 56
-
Re:That stinks.
But that also makes things like this possible. IIRC, the virus comes to you as a zipped MIME/html file. You unzip the file and double-click it and it extracts the virus binary from a base64 encoded section of the document.
This was the SOB that forced me to add ZIP and HTML files to the RenAttach bad list on our mail server. -
MS under fire
Here is an interesting description of the virus.
The virus obviously contains the following text:
I just want to say LOVE YOU SAN!!
billy gates why do you make this possible?
Stop making money and fix your software!!
And also as of August 16, 2003 the Lovesan will launch a DDoS attack on the Windowsupdate.com server.
Looks insteresting, to say the least -
Re:Virus in his codeNAVCE picked it up on my computer too. From Virus List, the exploit gives remote access via a command shell.
Sounds to me like the whole thing might be a really bogus attempt just to root people's boxen. I guess that's what happens when we rely on "news sources" for security information.
Course it could be a false-positive, too.
-
Re:I said this would happen, and it did.Well, after finding a description of how this attack works, it looks like it's dumber than I thought. Apparently, it just floods the Kazaa system with copies of itself under different names, hoping somebody will run them. If run, it puts itself in the registry to run at every startup.
So it requires manual intervention to propagate, and is thus more like a classic virus.
We may yet see a Brilliant Projector based worm, but this apparently isn't it.
-
Re:Pretty crazy stuff
Well, the primary reason would be the lack of any viruses to scan for.
There are a few:
http://www.viruslist.com/eng/viruslist.asp?id=3033 &key=000010000500002&page=0&mode=1
It is also important to note that this article is not about a virus. It is about a trojan
No, it's about a virus. It infects files. I would not also classify it as a trojan, but that's debatable.
The question with Linux binaries is are they what they claim to be. That question is generally answered with an MD5 sum from a trusted source. This renders the case of unknown trojans moot.
Unless the file gets infected before the author produces the MD5 sums.
Besides, there are plenty of Windows programs on Sourceforge, so it probably wouldn't hurt to scan. -
More information about the worm...
...can be found at VirusList. Appearantly, it installs a trojan hores which deletes files and cmos information on the next bootup.