From: morning_wood (se_cur_ityhotmail.com)
Date: Fri May 30 2003 - 21:09:56 CDT

• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

======================================
This is an exploitlabs.com false positive email agent test
======================================
BEGIN
--------------
Win32.Palyh.A (New!)
Win32.Fizzer (New!)
Win32/SQLSlammer.Worm
Win32.Sobig
Win32.Lirva.A
Win32.Yaha.K
Win32.Bugbear (Also known as Win32/Bugbear.Worm, WORM_NATOSTA.A,
Worm/Tanatos, Win32.Bugbear.Amm, Win32/Bugbear.A, )
Win32.Klez.H (Also known as Win32/Klez.H.Worm, WORM_KLEZ.G and
Win32.Klez.Hmm)
JDBGMGR.EXE Hoax
Win32.Nimda.A (Also known as W32/NimdaMM)
Win32.Nimda.E (also known as Win32.Nimda.C Worm)
Win32.Magistr.29188 (Also known as W32/Magistr.B, Win32.Magistr.Bmm and
I-Worm Magistr.b)
Win32.Sircam.137216
Win32.Hybris
Win32.Auric.A (Also known as Win32/Auric.A.Worm)
Win32.Holar.F (Also known as Win32/Holar.F.Worm, W32/Holar.hMM (McAFee))
Win32.Naco.B (Also known as W32/Meldrood.Bmm (F-Secure), Win32/Naco.Worm,
I-Worm.Nocana.b (Kaspersky))
Win32.Fibot.022 (Also known as Backdoor.IRC.Bot (Symantec),
Win32/IRCBot.26624.Trojan)
Win32.Lovgate.L (Also known as W32.HLLW.Lovgate.Imm (Symantec),
W32/Lovgate.IM (McAFee), Win32/LovGate.L.Worm)
Win32.Melare.Worm (Also known as W32.Ahlem.Amm (Symantec), I-Worm.Melare
(Kaspersky), Win32/Melare.Worm, W32/MelareMM (McAfee))
Win32.Thaprog (Also known as W32/Gant.bMM (McAfee), W32.HLLW.Redistmm
(Symantec), Win32/Thaprog.Worm)
Win32.Cult.H (Also known as Win32/Cult.C1.Worm, W32/Cult.worm.gen (McAfee),
W32.HLLW.Cult.Cmm (Symantec))
Win32.Sobig.B (Also known as W32.HLLW.Mankxmm (Symantec), I-Worm.Palyh
(Kaspersky) , Win32.Palyh.A, WORM_PALYH.A (Trend), Win32/Palyh.A.Worm ,
W32/PalyhMM (McAfee), I-Worm.Sobig.b (Kaspersky), Win32/Sobig.B.Worm,
W32/Sobig.bMM (McAfee), W32.SoBig.Bmm (Symantec))
Win32.Lovgate.I (Also known as W32.HLLW.Lovgate.Hmm (Symantec),
I-Worm.LovGate.F (Kaspersky))
----------
END

This was a text only message with NAMES only.

This test is a idea and concept by Donnie Werner of exploitlabs.com to test
the false positive reporting of current email AV agents. This test, and its
proceedures are the exclusive property of Donnie Werner and exploitlabs.com
and may not be used without express writen consent. Failure to obtain
permission from exploitlabs.com to recreate such a test will be prossecuted
to the full extent of the law as provided by the governing country of the
originating attempted test, the users ISP and DNS providers.

Donnie Werner
exploitlabs.com

"Chew on that Nick -n- ms Jimi"
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html

• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]