Earthstation 5 Claimed to be Malware

Rob from RPI writes "You may remember the announcement about a company, or program, or both called Earthstation 5 who recently 'Declared War' on the MPAA. Well guess what? Turns out that it's got code in it that allows anyone to delete any file on your computer. I suggest that you un-install as soon as possible!"

Comments

Geocites eh?

[Anonymous Coward]

Because the link is on geocities it's sure to be /.'d in 23 milliseconds. Here is a mirror I put up with the bin and src.
Don't trust code from sources you don't know. I only provide these for the inevitable geocities /.ing

Unconfirmed, as of yet.

[caferace]

This came across the FD list yesterday afternoon. Typically, an announcement of this type would elicit a fair amount of discussion. Usually at leat *one* other person would have confirmed it, or at least rebutted the claim.

As of this writing, I haven't seen a single follow-up post.

Is it true? I don't know, Is it a hoax? I don't know that either. It has more than a few caveats about using the exploit, that's for sure.

What I do know is that that Geocities site with the exploit code will disappear bandwidth constrained faster than snot. :)

Heres the trojan code

[ghost1]

Link to Zeropaid discussion with the actual code http://www.zeropaid.com/news/articles/auto/1002200 3i.php

Re:Now tell the bastards what you think!

[Anonymous Coward]

The *maintainer* of Earthstation V's domain record is fom Israel. I do not know what this signifies.

To see this, go here and click on the mnt-by ("maintained by") link.

person: Moshe Maimone
address: 63 Saudia Gaon
Hertzlya, Israel
phone: +39247585
nic-hdl: MM9905-RIPE
mnt-by: SPEEDNET-MNT
changed: Speednet@email.com 20030508
source: RIPE

person: Motti Oran
address: 25 Hasivin Street
Petach Tikva, Israel 49170
phone: +039247585
fax-no: +039247736
mnt-by: SPEEDNET-MNT
notify: speednet@email.com
e-mail: motti@speed-net.com
nic-hdl: MO2551-RIPE
changed: speednet@email.com 20030105
source: RIPE