Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email firstname.lastname@example.org
Re: [Full-Disclosure] Possible New Malware
From: GuidoZ (uberguidozgmail.com)
Date: Tue Sep 14 2004 - 11:42:39 CDT
www.VirusTotal.com will run it through quite a few all at once. You
can also do them individually if you like - search the archives for
the exact addresses.
On Tue, 14 Sep 2004 10:26:09 -0500, Ty Bodell <tebodellgmail.com> wrote:
> Kaspersky has one,
> ----- Original Message -----
> From: Perrymon, Josh L. <perrymonjbek.com>
> Date: Tue, 14 Sep 2004 09:02:13 -0500
> Subject: [Full-Disclosure] Possible New Malware
> To: full-disclosurelists.netsys.com
> Anyone Heard of BackDoor-CIW?
> This is a piece of malware with the .exe of winstr32.exe that is
> causing 99% CPU on a couple machine at a remote location. I found that
> one infected machine does not have MS04-11 patched. So that could be
> an attack vector.
> I get no luck googling for the .exe or BackDoor-CIW <---- This is
> what Postini identifies the file as.
> I'm trying to get a copy to put in my VMWare Lab.
> Also---- Isn't there a website that we can email this file to and it
> will run several AV solutions on it to find more info?
> Joshua Perrymon
> Sr. Network Security Consultant
> PGP Fingerprint
> 51B8 01AC E58B 9BFE D57D 8EF6 C0B2 DECF EC20 6021
> **********CONFIDENTIALITY NOTICE**********
> The information contained in this e-mail may be proprietary and/or
> privileged and is intended for the sole use of the individual or
> organization named above. If you are not the intended recipient or an
> authorized representative of the intended recipient, any review, copying
> or distribution of this e-mail and its attachments, if any, is prohibited.
> If you have received this e-mail in error, please notify the sender
> immediately by return e-mail and delete this message from your system.
Full-Disclosure - We believe in it.