[VulnDiscuss] Re: Opentype font file causes Windows to restart.

Hmmm... but it doesn't contain the string "C:\<Windows>\Start
Menu\Programs\StartUp\win32client.exe" as mentioned in the sophos
advisory... Also Symantec writes "This Trojan horse is inserted in the
C:\Windows\Start Menu\Programs\StartUp folder as the file Winmem.hta."
hta-files are HTml Applications, otf-files are OpenType Fonts.
My (up-to-date) Symantec virus scanner did not trigger when I ran it.
Neither did I find a trojan installed afterward. Maybe It's just that 31337
stealthy but I doubt it ;)

I guess the only thing this otf file and the trojans mentioned by SOPHOS and
SYMANTEC have incommon is their name and effect. Because they are named
after their effect, I believe the comparison ends there.

Berend-Jan Wever.

----- Original Message -----
From: "Tiina Anita Muukkonen" <[email protected]>
To: "Andrew" <[email protected]>
Cc: <[email protected]>; <[email protected]>
Sent: Tuesday, January 07, 2003 0:13
Subject: [VulnWatch] Re: Opentype font file causes Windows to restart.


> quoth Andrew on this day of Our Lord:
> |
> | The attached OpenType font file will cause Windows to restart
> | immediately when the file is opened by the default viewer (fontview).
> | I doubt anyone would suspect a "harmless" little font file of being
> | able to cause such a thing to happen!
>
>  I ran strings over it:
>
> OTTO
> CFF D@
> eOS/2^^\
> `cmap
> $head
> 6hhea
> $hmtx
> maxp
> name
> post
> restarter
> restarter
> NONE
> Copyright 2003. All rights
reserved.restarterRegular1.000;NONE;restarterOTF 1.000;PS 001.001;Core
1.0.29Please refer to the Copyright section for the font trademark
attribution notices.
>
>  and then entered 'restarter' into Google, which returned information on a
>  trojan called restarter that does just that. Sophos and Symantec have
>  descriptions of somewhat different versions of the trojan.
>
>  godspeed,
>
>  Tiina Muukkonen
>  System Administrator, CSE, UNSW
> --
> "When I was seven, my parents moved to Texas.                   ________
>  When I was nine, I found them." Steve Wright         (__)     /        \
>                                               `\------(oo)    ( Squeak!! )
> Tiina Muukkonen                                 ||    (__)  --'\________/
> [email protected]                          ||w--||
> http://www.cse.unsw.edu.au/~tiinam      \|/                  \|/
>