From: Alin Dobre (alin.dobreravantivirus.com)
Date: Mon Mar 08 2004 - 06:18:14 CST

• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

   Hello,

Lots of the latest malwares, on the affected systems, search for the
folders containing "shar" and copy themselves with various names.
As you can see the files are in a folder that contain the "shar" string
in its name.

Regards,
Alin.

Murat Akca wrote:
> Now I searched the computer and all these files are found in same location
>
>
> /home/onder/OpenOffice.org1.1/share/angels.pif
> /home/onder/OpenOffice.org1.1/share/autocorr/angels.pif
> /home/onder/OpenOffice.org1.1/share/autocorr/dolly_buster.jpg.pif
> /home/onder/OpenOffice.org1.1/share/autocorr/doom2.doc.pif
> /home/onder/OpenOffice.org1.1/share/autocorr/eminem - lick my pussy.mp3.pif
> /home/onder/OpenOffice.org1.1/share/dict/angels.pif
> /home/onder/OpenOffice.org1.1/share/dict/dolly_buster.jpg.pif
> /home/onder/OpenOffice.org1.1/share/dict/doom2.doc.pif
> /home/onder/OpenOffice.org1.1/share/dict/eminem - lick my pussy.mp3.pif
> /home/onder/OpenOffice.org1.1/share/dict/ooo/angels.pif
> /home/onder/OpenOffice.org1.1/share/dict/ooo/dolly_buster.jpg.pif
> /home/onder/OpenOffice.org1.1/share/dict/ooo/doom2.doc.pif
> /home/onder/OpenOffice.org1.1/share/dict/ooo/eminem - lick my pussy.mp3.pif
> /home/onder/OpenOffice.org1.1/share/dolly_buster.jpg.pif
> /home/onder/OpenOffice.org1.1/share/doom2.doc.pif
> /home/onder/OpenOffice.org1.1/share/eminem - lick my pussy.mp3.pif
> /home/onder/OpenOffice.org1.1/share/samples/angels.pif
> /home/onder/OpenOffice.org1.1/share/samples/dolly_buster.jpg.pif
> /home/onder/OpenOffice.org1.1/share/samples/doom2.doc.pif
> /home/onder/OpenOffice.org1.1/share/samples/eminem - lick my pussy.mp3.pif
> /home/onder/OpenOffice.org1.1/share/samples/english/angels.pif
> /home/onder/OpenOffice.org1.1/share/samples/english/dolly_buster.jpg.pif
> /home/onder/OpenOffice.org1.1/share/samples/english/doom2.doc.pif
> /home/onder/OpenOffice.org1.1/share/samples/english/eminem - lick my
> pussy.mp3.pif
> /home/onder/OpenOffice.org1.1/share/uno_packages/angels.pif
> /home/onder/OpenOffice.org1.1/share/uno_packages/dolly_buster.jpg.pif
> /home/onder/OpenOffice.org1.1/share/uno_packages/doom2.doc.pif
> /home/onder/OpenOffice.org1.1/share/uno_packages/eminem - lick my
> pussy.mp3.pif
>
>
>
> Any idea?
>
>
>
>
>
>
> On Monday 08 March 2004 14:06, Murat Akca wrote:
>
>>I have a big problem about k3b when I write cd's with k3b there are a lot
>>of files which I do not write for example:
>>
>>angels.pif
>>cool_screensaver.scr
>>dictionary.doc.exe
>>dolly_duster.jpg.pif
>>doom2.doc.pif
>>e-book.archive.doc.exe
>>e.book.doc.exe
>>eminem - lick my pussy.mp3.pif
>>hardcore porn.jpg.exe
>>how to hack.doc.exe
>>
>>
>>and lots of them.These files are copied recursively in all folders in
>>writed cds.I'm using suse 9.0 and last week I made Suse update using Yast.
>>
>>Do u have any idea?A linux virus?
>
>

--
Alin DOBRE
Technical Support Engineer - RAV Division
mailto:alin.dobreravantivirus.com
Tel./Fax: +40-21-321.78.03 Hotline: +40-21-321.78.59;
http://www.ravantivirus.com
Worry less! RAV is watching.
---------------------------
This message is confidential. It may also be privileged or otherwise
protected by work product immunity or other legal rules. If you have
received it by mistake please let us know by reply and then delete it
from your system; you should not copy the message or disclose its
contents to anyone.

--
Check the headers for your unsubscription address
For additional commands, e-mail: suse-security-helpsuse.com
Security-related bug reports go to securitysuse.de, not here

• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]