RE: [unisog] Winupdate2date.exe: New worm variant? ( The Answer)
Eric Peters <[email protected]>
| Newsgroups | gmane.comp.security.intrusions |
|---|---|
| Message-ID | <E4987A7A1042D511848F0008C71BB06B0431FB6F__13937.3206221082$1095878747$gmane$org@PCT_EXCH> |
I personally think it has to do with the story on /. And The Register about a new spam E-mail circulating which has a 'Click here to remove' link which launches to a site, (www.xcelent.biz) that site has on it a drag-drop javascript exploit; so when the user scrolls the page, it downloads windows-update32.exe (which I have open in a hex editor now). This only affects the millions of unpatched windows computers and people who use IE (internet exploder) There is a slew of other sites on that same server according to Webhosting Info that also have that exploit, some with windows-update.exe and others with windows-update32.exe The windows-update32.exe also references a site earthlabs.biz trying to use http get command to download ProxyBot? But that site has no DNS. More info later when I get time to go through the exe. host www.xcelent.biz www.xcelent.biz has address 61.218.79.53 host 61.218.79.53 53.79.218.61.in-addr.arpa domain name pointer 61-218-79-53.HINET-IP.hinet.net And people wonder why I want to firewall 60/7 Cheers, Eric -----Original Message----- From: Anderson Johnston [mailto:[email protected]] Sent: Tuesday, September 21, 2004 2:00 PM To: [email protected]; [email protected] Subject: [unisog] [Intrusions] Winupdate2date.exe: New worm variant? (The Answer) Jim Supplee of the College of William and Mary pointed me to a posting at www.cyberdefender.com. It's a new worm and here's hoping the anti-virus vendors get the new signatures out soon.. Thanks to all the respondents! - Andy ---------------------------------------------------------------------------- -- ** Andy Johnston ([email protected]) * ** ** * PGP key:(afj2002) 4096/8448B056 ** ** Office of Information Technology, UMBC * 4A B4 96 64 D9 B6 EF E3 21 9A ** ** 410-455-2583 (v)/410-455-1065 (f) * 46 1A 37 11 F5 6C 84 48 B0 56 ** ---------------------------------------------------------------------------- -- _______________________________________________ Intrusions mailing list [email protected] http://www.dshield.org/mailman/listinfo/intrusions _______________________________________________ unisog mailing list [email protected] http://www.dshield.org/mailman/listinfo/unisog _______________________________________________ Intrusions mailing list [email protected] http://www.dshield.org/mailman/listinfo/intrusions