[sdiy] [OT] PSA: List Member Virus Alert

[René Schmitz]

At 07:38 10.01.02, Scott Gravenhorst wrote:
>I received an infector attachment in an email
>with (some) header lines of:
>
>From: "Jay A Kolaric" <_jay_kolaric at bigpond.com>
>Subject: Re: Re: [sdiy] 555 vco success
>
>The attachment was named "DOCS.DOS.PIF", which is
>highly suspect in and of itself.  The email contained
>no text message.

Got a similar message, from him, the attachment was 
named "S3MSONG.DOC.scr".

>I wrote my own email system, so this did not affect me, 
>however I looked at the file with some binary tools
>and it is definately an executable which possibly
>attempts to manipulate several Windoze kernel files as
>well as winsock.dll and some registry entries.

Its a BadTrans.B1 Worm. Wildly common as it seems....


-- 
uzs159 at uni-bonn.de
http://www.uni-bonn.de/~uzs159